Protecting Enable And Enable Secret Passwords With Encryption; Disabling Password Recovery - Cisco IE-4000 Software Configuration Manual

Configuring Switch-Based Authentication
How to Configure Switch-Based Authentication

Protecting Enable and Enable Secret Passwords with Encryption

Command
1. configure terminal
2. enable password [level level] {password |
encryption-type encrypted-password}
or
enable secret [level level] {password |
encryption-type encrypted-password}
3. service password-encryption
4. end

Disabling Password Recovery

Command
1. configure terminal
2. no service password-recovery
3. end
4. show version
Purpose
Enters global configuration mode.
Defines a new password or changes an existing password
for access to privileged EXEC mode.
or
Defines a secret password, which is saved using a
nonreversible encryption method.

(Optional) level—Specifies the range is from 0 to 15.
Level 1 is normal user EXEC mode privileges. The
default level is 15 (privileged EXEC mode privileges).

password—Specifies a string from 1 to 25 alphanumeric
characters. The string cannot start with a number, is
case sensitive, and allows spaces but ignores leading
spaces. By default, no password is defined.

(Optional) encryption-type—Only type 5, a Cisco
proprietary encryption algorithm, is available. If you
specify an encryption type, you must provide an
encrypted password—an encrypted password that you
copy from another switch configuration.
Note: If you specify an encryption type and then enter a clear
text password, you cannot reenter privileged EXEC mode.
You cannot recover a lost encrypted password by any
method.
(Optional) Encrypts the password when the password is
defined or when the configuration is written.
Encryption prevents the password from being readable in
the configuration file.
Returns to privileged EXEC mode.
Purpose
Enters global configuration mode.
Disables password recovery.
This setting is saved in an area of the flash memory that is accessible by
the boot loader and the Cisco IOS image, but it is not part of the file
system and is not accessible by any user.
Returns to privileged EXEC mode.
Verifies the configuration by checking the last few lines of the command
output.
166