System Security; Protection Of Passwords; Secure Password Encryption - Cisco ASR 5500 System Administration Manual

System Security

This chapter describes the StarOS security features.
This chapter explores the following topics:
•
•
•
•
•
•

Protection of Passwords

Users with privilege levels of Inspector and Operator cannot display decrypted passwords in the configuration
file via the command line interface (CLI).

Secure Password Encryption

By default for StarOS releases prior to 21.0 the system encrypts passwords using an MD5-based cipher (option
A). These passwords also have a random 64-bit (8-byte) salt added to the password. The chassis key is used
as the encryption key.
Setting a chassis key supports an encryption method where the decryption requires the knowledge of a "shared
secret". Only a chassis with knowledge of this shared secret can access the passwords. To decipher passwords,
a hacker who knew the chassis key would still need to identify the location of the 64-bit random salt value
within the encryption.
Passwords encrypted with MD-5 will have "+A" prefixes in the configuration file to identify the methodology
used for encrypting.
Protection of Passwords, page 75
Support for ICSR Configurations, page 76
Encrypted SNMP Community Strings, page 77
Lawful Intercept Restrictions, page 77
Adding, Modifying and Removing Users, page 78
Test-Commands, page 79
C H A P T E R
ASR 5500 System Administration Guide, StarOS Release 21.5
8
75