Who can get in?
Out of the box, anyone with a console cable can walk up to a router and change anything. Three simple settings fix that:
| Setting | Command | Protects |
|---|---|---|
| Console password | line console 0 then password ... and login | Getting to the > prompt at all |
| Enable secret | enable secret ... | Going from > to # (privileged mode) |
| Password encryption | service password-encryption | Passwords being readable in show running-config |
enable secret vs enable password
enable password stores the password as plain text. enable secret stores a hash (a one-way scrambled version), so nobody can read it back. Always use enable secret. If both are set, the secret wins.
Locking the console
A line password does nothing on its own: login is what tells the line to ask for it.
In NetLab
▶ R1 Router>enable Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#hostname R1 R1(config)#enable secret Cl4ss!Lab R1(config)#line console 0 R1(config-line)#password C0ns0le! R1(config-line)#login R1(config-line)#logging synchronous R1(config-line)#exec-timeout 10 0 R1(config-line)#exit R1(config)#banner motd #Authorised access only. Activity may be monitored.# R1(config)#end *Mar 1 00:00:12.000: %SYS-5-CONFIG_I: Configured from console by console R1#show running-config | section line con line con 0 exec-timeout 10 0 password C0ns0le! logging synchronous login
logging synchronousstops log messages from breaking up the line you are typing.exec-timeout 10 0logs an idle session out after 10 minutes (0 seconds).banner motdshows a message to everyone who connects. The first character aftermotd(here#) marks where the text starts and ends.
Hiding passwords in the configuration
The console password above is still readable in the configuration. service password-encryption scrambles it as type 7:
In NetLab
▶ R1 Router>enable Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#line console 0 Router(config-line)#password C0ns0le! Router(config-line)#login Router(config-line)#exit Router(config)#service password-encryption Router(config)#do show running-config | include password service password-encryption password 7 08021C401A49091253
Common mistake: Type 7 is weak: free tools can turn it back into the real password in a second. It only stops someone reading a password over your shoulder. That is why the enable password should always be an
enable secret, which is a real hash.
See it from the outside
Leave the session with exit and press Enter: the router now shows the banner and asks for the console password.
In NetLab (the password you type is never shown)
▶ R1 Router>enable Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#banner motd #Authorised access only# Router(config)#line console 0 Router(config-line)#password C0ns0le! Router(config-line)#login Router(config-line)#end *Mar 1 00:00:07.000: %SYS-5-CONFIG_I: Configured from console by console Router#exit Router con0 is now available Press RETURN to get started. Authorised access only User Access Verification Password: Router>enable
Tip: Remote access over the network (SSH, user accounts, AAA servers) comes in the device management module. The console and enable passwords you set here are the first layer.