Setting Tacacs+ Password Protection For Privileged Exec Mode; Encrypting Passwords - Cisco 4500M Software Manual

Chapter 3 Configuring the Switch for the First Time
For information on how to display the password or access level configuration, see the
Password, Access Level, and Privilege Level Configuration" section on page

Setting TACACS+ Password Protection for Privileged EXEC Mode

For complete information about TACACS+ and RADIUS, refer to these publications:
•
•
To set the TACACS+ protocol to determine whether or not a user can access the privileged EXEC mode,
perform this task:
Command
Switch(config)# enable use-tacacs
When you set TACACS password protection at the privileged EXEC mode, the enable EXEC command
prompts you for a new username and a new password. This information is then passed to the TACACS+
server for authentication.
If you use extended TACACS, another extension to the older TACACS protocol that provides additional
functionality, it also passes any existing UNIX user identification code to the TACACS+ server.
Extended TACACS provides information about protocol translator and router use. This information is
used in UNIX auditing trails and accounting files.
Note When used without extended TACACS, the enable use-tacacs command allows anyone with a valid
username and password to access the privileged EXEC mode, creating a potential security risk. This
problem occurs because the query resulting from entering the enable command is indistinguishable from
an attempt to log in without extended TACACS.

Encrypting Passwords

Because protocol analyzers can examine packets (and read passwords), you can increase access security
by configuring the Cisco IOS software to encrypt passwords. Encryption prevents the password from
being readable in the configuration file.
To configure the Cisco IOS software to encrypt passwords, perform this task:
Command
Switch(config)# service password-encryption
OL-6696-01
The "Authentication, Authorization, and Accounting (AAA)" chapter in the Cisco IOS Security
Configuration Guide, Release 12.2, at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/secur_c/scprt1/index.htm
Cisco IOS Security Command Reference, Release 12.2, at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/secur_r/index.htm
Controlling Access to Privileged EXEC Commands
Purpose
Sets the TACACS-style user ID and
password-checking mechanism for the privileged
EXEC mode.
Purpose
Encrypts a password.
Software Configuration Guide—Release 12.2(25)EW
"Displaying the
3-17.
3-15