MigrationBot: Backfill (v3.0 review queue): added to the review queue

2026-09-22T05:43:00Z

Backfill (v3.0 review queue): added to the review queue

← Older revision		Revision as of 05:43, 22 September 2026
Line 123:		Line 123:
	[[Category:Cisco Packet Tracer\|040]]		[[Category:Cisco Packet Tracer\|040]]
	[[Category:Migrated from cypat.guide]]		[[Category:Migrated from cypat.guide]]
			[[Category:Pending review]]

MigrationBot: Import from cypat.guide: docs/cisco/Cisco Packet Tracer/basic_security.md

2026-09-18T18:18:45Z

Import from cypat.guide: docs/cisco/Cisco Packet Tracer/basic_security.md

New page

{{Submit}}


Author(s): a_person

Last Updated: 08-09-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

Introduction to Cisco IOS

|}

== Enable Password ==

The <code>enable password</code> command sets a password required to enter privileged EXEC mode on Cisco devices.

=== Syntax ===

<syntaxhighlight lang="text">Router(config)# enable password your_password</syntaxhighlight>
=== Important notes ===

* Stored in plain text in the configuration file
* Visible when viewing the running configuration
* Provides basic protection but not recommended for production environments
* Can be seen by anyone with access to the configuration

== Enable secret ==

The <code>enable secret</code> command provides a more secure alternative to the <code>enable password</code> command as it uses a hashing algorithm. When there are both <code>enable password</code> and <code>enable secret</code>, <code>enable secret</code> takes precedence because Cisco IOS always prefers the more secure option.

=== Syntax ===

<syntaxhighlight lang="text">Router(config)# enable secret your_password</syntaxhighlight>
== Protecting Console ==

This configuration secures console access to the device by applying a password requirement. It specifies the console line (<code>line console 0</code>), sets a password (<code>password your_console_password</code>), and enables password checking on login (<code>login</code>).

<syntaxhighlight lang="text">Router(config)# line console 0
Router(config-line)# password your_console_password
Router(config-line)# login</syntaxhighlight>
== Password Encryption Service ==

The <code>service password-encryption</code> command enables automatic encryption of passwords in the configuration file using Type 7 encryption. Later in the article, we will be talking about the differences between the various encryption types. <code>service password-encryption</code> is not strong security and is mainly for obscuring passwords from casual viewing.

'''What it affects:'''

* Line passwords (console, vty, aux)
* Enable password (but not enable secret)
* Username passwords (but not username secrets)
* SNMP community strings
* Other plaintext passwords in configuration

=== Syntax ===

<syntaxhighlight lang="text">Router(config)# service password-encryption</syntaxhighlight>
== Cisco Password Encryption Levels ==

Cisco devices use different encryption levels to secure passwords stored in configuration files:

=== Type 0 - Plain Text ===

* No encryption applied
* Password visible in clear text
* Default behavior without encryption services
* '''Example:''' <code>password 0 MyPassword123</code>

=== Type 7 - Cisco Proprietary Encryption ===

* Basic obfuscation using Vigenère cipher
* Reversible encryption (easily decoded)
* Enabled with <code>service password-encryption</code>
* '''Example:''' <code>password 7 094F471A1A0A464058</code>

=== Type 5 - MD5 Hash ===

* Uses MD5 hashing algorithm
* One-way encryption
* As you may or may not already know, MD5 is vulnerable to collision attacks, making it not as secure as other hashing algorithms.
* Used by <code>enable secret</code> and <code>username secret</code> commands
* '''Example:''' <code>enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0</code>

=== Type 8 - PBKDF2 with SHA-256 ===

* Password-Based Key Derivation Function 2
* Uses SHA-256 hashing with salt
* '''Example:''' <code>username admin secret 8 $8$mERr$hx5rVt7rPNoS4wqbXKX7m0$</code>

=== Type 9 - Scrypt ===

* Latest and most secure encryption type
* Uses scrypt key derivation function
* Resistant to hardware attacks
* '''Example:''' <code>username admin secret 9 $9$mERr$hx5rVt7rPNoS4wqbXKX7m0$</code>

== Practice ==

Do the following steps in order:

# Enable password encryption
# Set the secret to <code>C1sc0R0cks</code>
# Set the console password to <code>Cypat123!</code>

'''You must enter the FULL commands.'''

'''Interactive practice:''' [https://orionband.github.io/windowstst/cisco.html?i=config&q=service%20password-encryption:enable%20secret%20C1sc0R0cks:line%20console%200:password%20Cypat123!:login Open the practice widget (external site)]

== Labs ==

* [https://drive.google.com/file/d/132NG6fJ03XcguOsChH-JXqafaOxTZMXd/view?usp=sharing CCNA Lab 003 PKT download (JIT)]
* [https://www.youtube.com/watch?v=Gj-8agyq4yQ&list=PLxbwE86jKRgMQ4HTuaJ7yQgA2BoNwY9ct&index=4 CCNA Lab 003 walkthrough (JIT)]
* [https://drive.google.com/file/d/1SukSVB9OKMG49aiqwfOdqc1lU6jVigrW/view?usp=sharing Day 4 Basic Security Lab PKT download(JIT)]
* [https://drive.google.com/file/d/1SukSVB9OKMG49aiqwfOdqc1lU6jVigrW/view?usp=sharing Day 4 Basic Security Lab PKT walkthrough(JIT)]

== Supplementary Resources and Further Reading ==

* https://www.youtube.com/watch?v=IYbtai7Nu2g&list=PLxbwE86jKRgMpuZuLBivzlM8s2Dk5lXBQ&index=8&pp=iAQB
* https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960cx_3650cx/software/release/15-2_7_e/configuration_guide/b_1527e_consolidated_3560cx_2960cx_cg/m_sec_passpr_cg.pdf

[[Category:Cisco Packet Tracer|040]]
[[Category:Migrated from cypat.guide]]

Draft:Basic Router and Switch security - Revision history

MigrationBot: Backfill (v3.0 review queue): added to the review queue

MigrationBot: Import from cypat.guide: docs/cisco/Cisco Packet Tracer/basic_security.md