Cisco Systems 4500 Encrypting Passwords

3-22
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 3 Configuring the Switch for the First Time
Controlling Access to Privileged EXEC Commands
To enable TACACS+ accounting for each Cisco IOS privilege level and for network services, perform
this task, beginning in privileged EXEC mode:
To disable accounting, use the no aaa accounting {network | exec} {start-stop} method1... global
configuration command.
Displaying the TACACS+ Configuration
To display TACACS+ server statistics, use the show tacacs privileged EXEC command.
Encrypting Passwords
Because protocol analyzers can examine packets (and read passwords), you can increase access security
by configuring the Cisco IOS software to encrypt passwords. Encryption prevents the password from
being readable in the configuration file.
To configure the Cisco IOS software to encrypt passwords, enter this command:
Encryption occurs when the current configuration is written or when a password is configured. Password
encryption is applied to all passwords, including authentication key passwords, the privileged command
password, console and virtual terminal line access passwords, and Border Gateway Protocol (BGP)
neighbor passwords. The service password-encryption command keeps unauthorized individuals from
viewing your password in your configuration file.
Caution The service password-encryption command does not provide a high-level of network security. If you
use this command, you should also take additional network security measures.
Although you cannot recover a lost encrypted password (that is, you cannot get the original password
back), you can regain control of the switch after having lost or forgotten the encrypted password. See
the “Recovering a Lost Enable Password” section on page 3-25 for more information.
Command Purpose
Step 1 configure terminal Enters global configuration mode.
Step 2 aaa accounting network start-stop
tacacs+ Enables TACACS+ accounting for all network-related service requests.
Step 3 aaa accounting exec start-stop
tacacs+ Enables TACACS+ accounting to send a start-record accounting notice
at the beginning of a privileged EXEC process and a stop-record at the
end.
Step 4 end Returns to privileged EXEC mode.
Step 5 show running-config Verifies your entries.
Step 6 copy running-config startup-config (Optional) Saves your entries in the configuration file.
Command Purpose
Switch(config)# service password-encryption Encrypts a password.