| 2.1 |  | General Router and Switch Security |
| 2.1.4 |  | Passwords |

| Passwords are the most critical tools in controlling access to a router. There are two password protection schemes in Cisco IOS:

1. Type 7 uses the Cisco-defined encryption algorithm, which is not as strong as Type 5 encryption.
2. Type 5 uses an MD5 hash, which is much stronger. Cisco recommends that Type 5 encryption be used instead of Type 7 where possible. Type 7 encryption is used by the

enable password, username, and line password commands.

To protect the privileged EXEC level as much as possible, do not use the

enable password command. Use the enable secret command. Even if the enable secret is set, do not set the enable password because it will not be used and may give away a system password .

No user account should be created above privilege level 1 since it is not possible to use Type 5 encryption on the default EXEC login or the username command. User accounts should be created for auditing purposes. The username command should be used to create individual user accounts at the EXEC level and then the higher privilege levels should be protected with the enable secret password. Users with a need to work at higher levels would be given the higher privilege level password.

If the

login command is used to protect a line, then the password command is the only way to set a password on a line. But if the login local command is used to protect a line then the specified user name and password pair is used. For access and logging reasons use the login local command.

The privileged EXEC secret password should not match any other user password. Do not set any user or line password to the same value as any

enable secret password.

The

service password-encryption command will keep passersby from reading passwords that are displayed on the screen. Be aware that there are some secret values that service password-encryption does not protect . Never set any of these secret values to the same string as any other password.

Good password practices include the following:

- Avoid dictionary words, names, phone numbers, and dates.
- Include at least one lowercase letter, uppercase letter, digit, and special character.
- Make all passwords at least eight characters long.
- Avoid more than four digits or same-case letters in a row.

| Web Links http://www.cisco.com/warp/public/474/index.shtml