Passwords

• By default, console access requires no password.
• By default, ssh and telnet to a switch (and other net devs) is disabled
• Enable mode has its own password

Login with passwords and exec to enable mode:

User Access Verification

Password: faith
Switch> enable
Password: love
Switch#

Set passwords for console:

sw01>en
sw01# conf t
Enter configuration commands, one per line.  End with CNTL/Z.
sw01(config)#line con 0
sw01(config-line)#password faith

Set passwords for vty:

sw01>en
sw01#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
sw01(config)#line vty 0 15
sw01(config-line)#password vtyfaith

Securing User Mode Access with Local Usernames and Passwords

Cisco switches support two other login security methods that both use per-user username/password pairs instead of a shared password with no username. One method, referred to as local usernames and passwords, configures the username/password pairs locally-that is, in the switch’s configuration. Switches support this local username/password option for the console, for Telnet, and even for SSH, but do not replace the enable password used to reach enable mode.

sw01>en
sw01# conf t
Enter configuration commands, one per line.  End with CNTL/Z.
sw01(config)#line con 0
sw01(config-line)#login local
sw01(config-line)#no password

sw01# username rtn password mypassword
sw01# !or ....
sw01# username rtn secret mypassword

** passwords are stored in cleartext (you can view them in the show run output) Secrets are not in cleartext**

Securing User Mode Access with External Authentication Servers