5.2 Device Access Control and Password Policies
Key Takeaways
- Use 'enable secret' instead of 'enable password' — it uses stronger hashing (MD5 or scrypt).
- The 'service password-encryption' command encrypts plain-text passwords in the running config (Type 7, weak).
- Configure SSH on VTY lines and disable Telnet to prevent credentials from being sent in plain text.
- Apply the principle of least privilege — give users only the access they need.
- Use centralized AAA (TACACS+ or RADIUS) instead of local passwords for enterprise deployments.
Device Access Control and Password Policies
Securing access to network devices is a fundamental security requirement. The CCNA tests your ability to configure and verify device access controls.
Securing Passwords
Enable Secret vs. Enable Password
| Command | Encryption | Strength |
|---|---|---|
enable password Cisco123 | Type 0 (plain text) or Type 7 | Weak — avoid |
enable secret Cisco123 | Type 5 (MD5) or Type 9 (scrypt) | Strong — always use |
Router(config)# enable secret StrongPassword123 ! Always use enable secret
If both are configured, enable secret takes priority.
Service Password-Encryption
Router(config)# service password-encryption
This command encrypts all plain-text passwords in the running configuration using Type 7 encryption. Type 7 is easily reversible (it's really just obfuscation, not true encryption), but it prevents casual shoulder-surfing.
Password Types on Cisco Devices
| Type | Algorithm | Strength | Example |
|---|---|---|---|
| Type 0 | Plain text | None | password Cisco123 |
| Type 5 | MD5 hash | Medium | $1$mERr$hx5... |
| Type 7 | Vigenere cipher | Weak (reversible) | 070C285F4D06 |
| Type 8 | PBKDF2-SHA-256 | Strong | $8$dsYG... |
| Type 9 | scrypt | Strongest | $9$nhEmQ... |
Router(config)# username admin secret StrongPass ! Creates Type 9 (scrypt) hash on newer IOS
Securing Console Access
Router(config)# line console 0
Router(config-line)# password ConsolePass123
Router(config-line)# login ! Enable password authentication
Router(config-line)# exec-timeout 5 0 ! Auto-logout after 5 minutes idle
Router(config-line)# logging synchronous ! Prevent log messages from interrupting input
Securing VTY (Remote Access) Lines
Router(config)# line vty 0 15
Router(config-line)# transport input ssh ! SSH only — blocks Telnet
Router(config-line)# login local ! Use local username database
Router(config-line)# exec-timeout 10 0 ! 10-minute idle timeout
Router(config-line)# access-class 10 in ! Apply ACL to restrict source IPs
AAA (Authentication, Authorization, Accounting)
AAA provides centralized security management for network devices.
| Component | Function | Example |
|---|---|---|
| Authentication | Verifies identity — "Who are you?" | Username/password, certificates, biometrics |
| Authorization | Determines permissions — "What can you do?" | Command authorization, privilege levels |
| Accounting | Records actions — "What did you do?" | Logging commands, session duration, bytes transferred |
TACACS+ vs. RADIUS
| Feature | TACACS+ | RADIUS |
|---|---|---|
| Standard | Cisco-proprietary | Open standard (RFC 2865) |
| Protocol | TCP port 49 | UDP ports 1812/1813 |
| Encryption | Entire packet encrypted | Only password encrypted |
| AAA separation | Separates authentication, authorization, and accounting | Combines authentication and authorization |
| Command authorization | Yes (granular) | No |
| Best for | Device management (controlling who can run which commands) | Network access (802.1X, VPN, wireless) |
On the Exam: TACACS+ is preferred for device administration (it separates AAA and encrypts the entire packet). RADIUS is preferred for network access control (802.1X, wireless). Know the port numbers and encryption differences.
Password Policy Best Practices
| Practice | Implementation |
|---|---|
| Minimum length | At least 10 characters |
| Complexity | Mix of uppercase, lowercase, numbers, symbols |
| No reuse | Don't reuse recent passwords |
| Account lockout | Lock after 3-5 failed attempts |
| Privileged access | Use enable secret (Type 5/8/9), not enable password |
| Encrypt stored passwords | service password-encryption + Type 5/8/9 |
| Centralized management | Use TACACS+/RADIUS instead of local passwords |
Why should you use "enable secret" instead of "enable password"?
Which AAA protocol encrypts the entire packet and is preferred for device administration?
What does the "service password-encryption" command do on a Cisco device?