Content

| 1.5 |  | Important IOS Features |
| 1.5.3 |  | Password recovery |

Each networking device has its own procedure for recovering passwords. For Cisco devices, the procedures are conveniently organized by platform at http://www.cisco.com/warp/public/474/.

As with many security situations, it is extremely important to consider physical security of the equipment. As demonstrated in the password recovery process, an attacker simply needs the ability to reboot the Catalyst switch and access the console to get into the privileged mode. When in the privileged mode, the attacker can make any changes that he or she desires. Keep the wiring closets secured and minimize access to console ports.

The following steps for recovering passwords apply to the Catalyst 2950 and 3550 switches and assume a console connection is used.

Step 1 | Unplug the power cable.

Step 2

Hold down the MODE button located on the left side of the front panel while reconnecting the power cord to the switch. Release the mode button a second or two after the LED above port 1x is no longer lit. The following instructions appear:

The system has been interrupted prior to initializing the flash file system. The following commands will initiate the flash file system, and finish loading the operating system software:

> flash_init
> load_helper
> boot

Step 3 | Type flash_init. This initializes the Flash file system.
Step 4 | Type load_helper. This loads and initializes the helper image, which is a minimal IOS image stored in ROM that is typical for disaster recovery.
Step 5 | Type dir flash: (do not forget the colon). This displays a list of files and directories in the Flash file system.
Step 6 | Type rename flash:config.text flash:config.old to rename the configuration file. This is the file that contains the password definition.
Step 7 | Type boot to reboot the system.
Step 8 | Enter n (for “no”) at the prompt to by-pass the System Configuration Dialog.
Step 9 | At the normal switch prompt, type enable to enter the privileged mode.
Step 10 | Type rename flash:config.old flash:config.text to rename the configuration file to its original name.

Step 11

Copy the configuration file, config.text into running-configuration as shown below:

> Switch#copy startup-config running-config
> Destination filename [running-config]? <press ENTER>
> 1613 bytes copied in 1.316 secs (1613 bytes/sec)
> Switch#

The configuration is now reloaded.

Step 12

Change the password or passwords:

> Switch#configure terminal
> Switch(config)#no enable password
> Switch(config)#enable secret cisco
> Switch(config)#^Z

Step 13

Save the running-configuration to the configuration file:

> Switch#copy running-configuration startup-configuration

This procedure is more complicated than a Cisco router password recovery.