how to configure password encryption on cisco 2950 switch

#How to configure password encryption on cisco 2950 switch how to#
#How to configure password encryption on cisco 2950 switch cracked#

– Verify that john’s username was encrypted after enabling the password encryption service by viewing the user names in the running-configuration as shown below – In global configuration mode enable the password encryption service by executing the service password-encryption as shown below Username john privilege 15 password 0 Cisco Username tom privilege 15 secret 5 $1$ID2R$2AKUK4US6yUQVkggSMkLV0 TIP: You can view the user names in the running-configuration by using a regular expression as shown below – Verify that the user accounts tom and john were created by viewing the running configuration. – Configure a user account locally using the username john and the password Cisco – Configure a user account locally using the username tom and the secret CiscoĮnter configuration commands, one per line.

Disable the password encryption service and view if type 5 encryption is removed automatically when the password-encryption service is disabled.

Verify that john’s username was encrypted after enabling the password encryption service.

In global configuration mode enable the password encryption service by executing the service password-encryption.

Verify that the user accounts tom and john were created by viewing the running configuration.

Configure a user account locally using the username john and the password Cisco.

Configure a user account locally using the username tom and the secret Cisco.

#How to configure password encryption on cisco 2950 switch cracked#

So when someone tells you that the type5 can be cracked by a rainbow table is completely incorrect as a standard rainbow table will NOT work because a standard rainbow table does not have MD5 hash values for every possible salted password hashed value that Cisco IOS can generate. Keep in mind salt is randomly generated and stored with the password hash which makes it nearly impossible to even create a rainbow for every current value of the standard md5 rainbow table because you don’t know the function in how the “Salt” is used as well as you cannot write a script to set the password on a Cisco device to every possible password found in the rainbow table as the salt is randomly generated every time you use the “enable secret XXXX” command.

Ultimately the point I’m tryign to make is that the technique in which Cisco uses the SALT function is proprietary. For example lets say we use the password Hello123 and Cisco places the randomly generated salt after the 2nd character in the actual passphrase, the prehashed password value would than become “He”$SALT”llo123 in which case would give you a unique md5 string. Salts are used in a manner to ensure extra security for md5 strings making them unique and proprietary to the salt function written. Cisco does not publish how the “salt” is technically used in the calculation of the md5 hash therefore it is “unknown”. Using the Type 5 password hash found in the lab instruction of this lab, $1 represents the Cisco type 5 password, the $ID2R which represents the “salt” and $2AKUK4US6yUQVkggSMkLV0 is the actual MD5 hash that is calculated with the “salt”. Type 5 password hashes cannot be decrypted with rainbow tables due to the fact the Type 5 password hash is divided into 3 separate sections. Keep in mind type 7 passwords are considered weak whereas type 5 passwords are “uncrackable” pe se. If it matches then the authentication is successful, if not then authentication is not and your password is declined. When you authenticate to a Cisco device that stores the password in MD5 format, the device encrypts the password string you provided and matches it to the string stored in configuration. This password cannot be “decrypted” due to the nature of the algorithm. Type 5 passwords use a MD5 hash which is a one-way (non-reversible) 128bit algorithm.

When posting configurations online to share be sure to remove the type 7 encrypted passwords as these passwords can be easily cracked. There is however a good use for this encryption service which is to prevent peaking tom’s from looking over your shoulder while you have a configuration displayed on screen from viewing clear text passwords.

#How to configure password encryption on cisco 2950 switch how to#

This lab you will teach you how to configure the password encryption service to encrypt clear text passwords using to level 7 encryption on a Cisco Router and/or Switch. An example website being this website here. There are many websites that offer a decryption applet to allow you to copy and paste a service password encrypted hash and decrypt the hash for you to clear text. Level 7 encryption on a Cisco device by today’s cryptographic standards is considered extremely weak.