Content

| 9.4 |  | Basic Security |
| 9.4.7 |  | Basic password protection |

The factory-default configuration for Cisco IOS devices does not contain any passwords.

Cisco IOS-based devices support three types of local passwords for use with both out-of-band and in-band connections:

- Enable and secret passwords
- Line passwords
- Local user names and passwords

By default, all passwords in a Cisco IOS device are stored in clear-text (that is, not protected by encryption) , with the exception of the optional enable secret password. These passwords can be encrypted using the global configuration service password-encryption command. Notice that the enable password line in the configuration script now has the number 7 before the encrypted password. This tells the IOS that the string of numbers and letters is an encrypted password.

Every method of accessing the device should have a password applied to prevent unauthorized access. By default, there is no password protection on console or auxiliary ports. The enable password is the password used to restrict access to priviliged EXEC mode.

Passwords defined for individual console, auxiliary or virtual terminal lines are called line passwords.

Cisco IOS devices can also store locally defined user names as passwords. Using local user names and passwords allows the network administrator to create individual logins for users, and define additional options and controls on a per-user basis. Using the advanced options with local user names is covered later in this module.

It is better to have users log into the system using an individual username and password rather than having everyone use the line password. Having users log in to the device using their own user name makes it easier to track down who is accessing the device and what changes they have made.