A line password (password cisco + login) is one password everybody shares: you can't tell who logged in, and you can't lock out one person. Local users fix that.
| Command | Does |
|---|---|
username anna secret S3cret! | A user with a hashed secret (always use secret, not password) |
username anna privilege 15 secret ... | She lands straight in privileged EXEC (#) |
login local (line mode) | This line asks for a user name and password from the local users |
security passwords min-length 10 | Refuse new passwords shorter than 10 characters |
show users | Who is logged in, on which line, from where |
In NetLab
▶ R1 R1>enable R1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)#security passwords min-length 10 R1(config)#username anna secret short % Password too short - must be at least 10 characters. Password configuration failed R1(config)#username anna privilege 15 secret Anna!Admin1 R1(config)#username bob secret Bob!Helpdesk1 R1(config)#line con 0 R1(config-line)#login local R1(config-line)#end *Mar 1 00:00:09.000: %SYS-5-CONFIG_I: Configured from console by console R1#show running-config | include username|min-length security passwords min-length 10 username anna privilege 15 secret 5 $1$C4OU$0IlR3RUJH9sWZoAoodQN20 username bob secret 5 $1$ez4Q$RQxigooR1JMm4p93Ea91zu R1#exit R1 con0 is now available Press RETURN to get started. User Access Verification Username: bob Password: R1>show users Line User Host(s) Idle Location * 0 con 0 bob idle 00:00:00 Interface User Mode Idle Peer Address
Bob has the default privilege level 1, so he lands in user EXEC (R1>). Anna would land in privileged EXEC (R1#).
Tip: Privilege levels go from 0 to 15. Level 1 is user EXEC, level 15 is everything. The levels between can be given chosen commands, but that's beyond the CCNA.
Common mistake:
username x password ...stores the password in clear text (or weak type 7). Usesecret, which is hashed.