The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The following are the restrictions for controlling switch access with passwords and privileges:
Disabling password recovery will not work if you have set the switch to boot up manually by using the boot manual global configuration command. This command produces the boot loader prompt (switch:) after the switch is power cycled.
Information About Passwords and Privilege Levels
A simple way of providing terminal access control in your network is to use passwords and assign privilege levels. Password protection restricts access to a network or network device. Privilege levels define what commands users can enter after they have logged into a network device.
This table shows the default password and privilege level configuration.
|
Feature |
Default Setting |
|---|---|
|
Enable password and privilege level |
No password is defined. The default is level 15 (privileged EXEC level). The password is not encrypted in the configuration file. |
|
Enable secret password and privilege level |
No password is defined. The default is level 15 (privileged EXEC level). The password is encrypted before it is written to the configuration file. |
|
Line password |
No password is defined. |
To provide an additional layer of security, particularly for passwords that cross the network or that are stored on a Trivial File Transfer Protocol (TFTP) server, you can use either the enable password or enable secret global configuration commands. Both commands accomplish the same thing; that is, you can establish an encrypted password that users must enter to access privileged EXEC mode (the default) or any privilege level you specify.
We recommend that you use the enable secret command because it uses an improved encryption algorithm.
If you configure the enable secret command, it takes precedence over the enable password command; the two commands cannot be in effect simultaneously.
If you enable password encryption, it applies to all passwords including username passwords, authentication key passwords, the privileged command password, and console and virtual terminal line passwords.
By default, any end user with physical access to the switch can recover from a lost password by interrupting the boot process while the switch is powering on and then by entering a new password.
The password-recovery disable feature protects access to the switch password by disabling part of this functionality. When this feature is enabled, the end user can interrupt the boot process only by agreeing to set the system back to the default configuration. With password recovery disabled, you can still interrupt the boot process and change the password, but the configuration file (config.text) and the VLAN database file (vlan.dat) are deleted.
If you disable password recovery, we recommend that you keep a backup copy of the configuration file on a secure server in case the end user interrupts the boot process and sets the system back to default values. Do not keep a backup copy of the configuration file on the switch. If the switch is operating in VTP transparent mode, we recommend that you also keep a backup copy of the VLAN database file on a secure server. When the switch is returned to the default system configuration, you can download the saved files to the switch by using the Xmodem protocol.
To re-enable password recovery, use the service password-recovery global configuration command.
When you power-up your switch for the first time, an automatic setup program runs to assign IP information and to create a default configuration for continued use. The setup program also prompts you to configure your switch for Telnet access through a password. If you did not configure this password during the setup program, you can configure it when you set a Telnet password for a terminal line.
You can configure username and password pairs, which are locally stored on the switch. These pairs are assigned to lines or ports and authenticate each user before that user can access the switch. If you have defined privilege levels, you can also assign a specific privilege level (with associated rights and privileges) to each username and password pair.
Cisco switches (and other devices) use privilege levels to provide password security for different levels of switch operation. By default, the Cisco IOS software operates in two modes (privilege levels) of password security: user EXEC (Level 1) and privileged EXEC (Level 15). You can configure up to 16 hierarchical levels of commands for each mode. By configuring multiple passwords, you can allow different sets of users to have access to specified commands.
Users can override the privilege level you set using the privilege level line configuration command by logging in to the line and enabling a different privilege level. They can lower the privilege level by using the disable command. If users know the password to a higher privilege level, they can use that password to enable the higher privilege level. You might specify a high level or privilege level for your console line to restrict line usage.
For example, if you want many users to have access to the clear line command, you can assign it level 2 security and distribute the level 2 password fairly widely. But if you want more restricted access to the configure command, you can assign it level 3 security and distribute that password to a more restricted group of users.
When you set a command to a privilege level, all commands whose syntax is a subset of that command are also set to that level. For example, if you set the show ip traffic command to level 15, the show commands and show ip commands are automatically set to privilege level 15 unless you set them individually to different levels.
How to Control Switch Access with Passwords and Privilege Levels
The enable password controls access to the privileged EXEC mode. Follow these steps to set or change a static enable password:
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
| Step 2 |
configure terminal Example: |
Enters global configuration mode. |
| Step 3 |
enable password password Example: |
Defines a new password or changes an existing password for access to privileged EXEC mode. By default, no password is defined. For password , specify a string from 1 to 25 alphanumeric characters. The string cannot start with a number, is case sensitive, and allows spaces but ignores leading spaces. It can contain the question mark (?) character if you precede the question mark with the key combination Crtl-v when you create the password; for example, to create the password abc?123, do this:
When the system prompts you to enter the enable password, you need not precede the question mark with the Ctrl-v; you can simply enter abc?123 at the password prompt. |
| Step 4 |
end Example: |
Returns to privileged EXEC mode. |
| Step 5 |
show running-config Example: |
Verifies your entries. |
| Step 6 |
copy running-config startup-config Example: |
(Optional) Saves your entries in the configuration file. |
Follow these steps to establish an encrypted password that users must enter to access privileged EXEC mode (the default) or any privilege level you specify:
| Command or Action | Purpose | |||
|---|---|---|---|---|
| Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
||
| Step 2 |
configure terminal Example: |
Enters global configuration mode. |
||
| Step 3 |
Use one of the following:
Example:or |
|
||
| Step 4 |
service password-encryption Example: |
(Optional) Encrypts the password when the password is defined or when the configuration is written. Encryption prevents the password from being readable in the configuration file. |
||
| Step 5 |
end Example: |
Returns to privileged EXEC mode. |
||
| Step 6 |
show running-config Example: |
Verifies your entries. |
||
| Step 7 |
copy running-config startup-config Example: |
(Optional) Saves your entries in the configuration file. |
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
enable Example: |
Enables privileged EXEC mode. Enter your password, if prompted. |
| Step 2 |
configure terminal Example: |
Enters global configuration mode. |
| Step 3 |
Use one of the following:
Example:or |
|
| Step 4 |
end Example: |
Exits global configuration mode and returns to privileged EXEC mode. |
Follow these steps to disable password recovery to protect the security of your switch:
If you disable password recovery, we recommend that you keep a backup copy of the configuration file on a secure server in case the end user interrupts the boot process and sets the system back to default values. Do not keep a backup copy of the configuration file on the switch. If the switch is operating in VTP transparent mode, we recommend that you also keep a backup copy of the VLAN database file on a secure server. When the switch is returned to the default system configuration, you can download the saved files to the switch by using the Xmodem protocol.
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
| Step 2 |
configure terminal Example: |
Enters global configuration mode. |
| Step 3 |
no service password-recovery Example: |
Disables password recovery. This setting is saved in an area of the flash memory that is accessible by the boot loader and the Cisco IOS image, but it is not part of the file system and is not accessible by any user. |
| Step 4 |
end Example: |
Returns to privileged EXEC mode. |
| Step 5 |
show running-config Example: |
Verifies your entries. |
| Step 6 |
copy running-config startup-config Example: |
(Optional) Saves your entries in the configuration file. |
To re-enable password recovery, use the service password-recovery global configuration command.
Beginning in user EXEC mode, follow these steps to set a Telnet password for the connected terminal line:
Attach a PC or workstation with emulation software to the switch console port, or attach a PC to the Ethernet management port.
The default data characteristics of the console port are 9600, 8, 1, no parity. You might need to press the Return key several times to see the command-line prompt.
| Command or Action | Purpose | |||
|---|---|---|---|---|
| Step 1 |
enable Example: |
Enters privileged EXEC mode. |
||
| Step 2 |
configure terminal Example: |
Enters global configuration mode. |
||
| Step 3 |
line vty 0 15 Example: |
Configures the number of Telnet sessions (lines), and enters line configuration mode. There are 16 possible sessions on a command-capable SwitchDevice. The 0 and 15 mean that you are configuring all 16 possible Telnet sessions. |
||
| Step 4 |
password password Example: |
Sets a Telnet password for the line or lines. For password , specify a string from 1 to 25 alphanumeric characters. The string cannot start with a number, is case sensitive, and allows spaces but ignores leading spaces. By default, no password is defined. |
||
| Step 5 |
end Example: |
Returns to privileged EXEC mode. |
||
| Step 6 |
show running-config Example: |
Verifies your entries. |
||
| Step 7 |
copy running-config startup-config Example: |
(Optional) Saves your entries in the configuration file. |
Follow these steps to configure username and password pairs:
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
| Step 2 |
configure terminal Example: |
Enters global configuration mode. |
| Step 3 |
username name [privilege level] {password encryption-type password} Example: |
Sets the username, privilege level, and password for each user.
|
| Step 4 |
Use one of the following:
Example:or |
Enters line configuration mode, and configures the console port (line 0) or the VTY lines (line 0 to 15). |
| Step 5 |
login local Example: |
Enables local password checking at login time. Authentication is based on the username specified in Step 3. |
| Step 6 |
end Example: |
Returns to privileged EXEC mode. |
| Step 7 |
show running-config Example: |
Verifies your entries. |
| Step 8 |
copy running-config startup-config Example: |
(Optional) Saves your entries in the configuration file. |
Follow these steps to set the privilege level for a command:
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
| Step 2 |
configure terminal Example: |
Enters global configuration mode. |
| Step 3 |
privilege mode level level command Example: |
Sets the privilege level for a command.
|
| Step 4 |
enable password level level password Example: |
Specifies the password to enable the privilege level.
|
| Step 5 |
end Example: |
Returns to privileged EXEC mode. |
| Step 6 |
copy running-config startup-config Example: |
(Optional) Saves your entries in the configuration file. |
Follow these steps to change the default privilege level for the specified line:
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
| Step 2 |
configure terminal Example: |
Enters global configuration mode. |
| Step 3 |
line vty line Example: |
Selects the virtual terminal line on which to restrict access. |
| Step 4 |
privilege level level Example: |
Changes the default privilege level for the line. For level , the range is from 0 to 15. Level 1 is for normal user EXEC mode privileges. Level 15 is the level of access permitted by the enable password. |
| Step 5 |
end Example: |
Returns to privileged EXEC mode. |
| Step 6 |
copy running-config startup-config Example: |
(Optional) Saves your entries in the configuration file. |
Users can override the privilege level you set using the privilege level line configuration command by logging in to the line and enabling a different privilege level. They can lower the privilege level by using the disable command. If users know the password to a higher privilege level, they can use that password to enable the higher privilege level. You might specify a high level or privilege level for your console line to restrict line usage.
Beginning in user EXEC mode, follow these steps to log into a specified privilege level and exit a specified privilege level.
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
enable level Example: |
Logs in to a specified privilege level. Following the example, Level 15 is privileged EXEC mode. For level , the range is 0 to 15. |
| Step 2 |
disable level Example: |
Exits to a specified privilege level. Following the example, Level 1 is user EXEC mode. For level , the range is 0 to 15. |
|
show privilege |
Displays the privilege level configuration. |
This example shows how to change the enable password to l1u2c3k4y5. The password is not encrypted and provides access to level 15 (traditional privileged EXEC mode access):
SwitchDevice(config)# enable password l1u2c3k4y5
This example shows how to configure the encrypted password $1$FaD0$Xyti5Rkls3LoyxzS8 for privilege level 2:
SwitchDevice(config)# enable secret level 2 5 $1$FaD0$Xyti5Rkls3LoyxzS8
The following example shows how to configure the masked secret password:
Device> enable
Device# configure terminal
Device(config)# username cisco masked-secret
Enter secret: ******
Confirm secret: ******
The following example shows how to configure the masked secret password forfor common criteria policy:
Device> enable
Device# configure terminal
Device(config)# username cisco common-criteria-policy test-policy masked-secret
Enter secret: ******
Confirm secret: ******
This example shows how to set the Telnet password to let45me67in89:
SwitchDevice(config)# line vty 10
SwitchDevice(config-line)# password let45me67in89
This example shows how to set the configure command to privilege level 14 and define SecretPswd14 as the password users must enter to use level 14 commands:
SwitchDevice(config)# privilege exec level 14 configure
SwitchDevice(config)# enable password level 14 SecretPswd14
Feedback