So at the moment, I've configured and enabled password of Cisco, no service password-encryption is
configured, which means that the password is shown in clear text.
The advantage of an enabled password is when I type in able I'm asked to enter a password.
When you connect to a live router by default, you're in user mode and if an enabled password hasn't
been configured, you are immediately able to access privilege mode or enable mode.
but when a password is configured, you'll be prompted to enter the password before you can access that
mode.
Now, Cisco recommend that you use enable secret rather than enable password, and that's because this
uses a better encryption.
Uses MD5 hashing to hash a password, I'll show you a demonstration of hashing in a moment.
In a similar way to the enable password, we can enter 0, which means we're entering the password
as unencrypted or 5, which means that the password that follows is encrypted.
You don't have to enter 0 by default either.
So I'm just going to say enable secret Cisco
but notice what happens.
I'm told that the enable secret you have chosen is the same as the enable password.
This is not recommended.
Re-enter the enable password when I type show run pipe include enable.
You'll notice it did accept the secret password but I'm told that I should re-enter the password.
So let's follow Cisco's advice and I'll set the password to hello.
So enable secret
Hello.
Now when I type controls zed or control z and disable and type enable I'm actually typing hello rather
than Cisco to access the privilege mode or enable mode.
When I type show run will do the full running-config so that you can see it in the output.
Notice no service
password encryption is configured, but the secret password is hashed.
It's encrypted by default.
You can't decrypt that in the same way that I showed you using the hacking tool.
The hacking tool only works with type 7 passwords and this is a lot more secure than type 7.
Now I've shown you how to hack type 7 password.
It's not as easy to do that with a MD5 password.
This tool is also available as part of the course.
Look below the video to use it.
This is a hashing application that shows you MD5 hashing versus SHA hashing versus SHA 256, SHA 512
and SHA 384, MD5 hashes are 128 bits in length and it's actually recommended for VPN or virtual private
networks that you don't use
MD5 hashes, but Cisco routers are still using MD5 hashes for the secret password.
If I configure a password of Cisco and then click hash, this application will show me the hexadecimal
hash of that password, the binary hash, as well as the SHA hashes of that password
and what you'll notice is the SHA passwords are a lot longer.
These are hex of values.
So each value that you see here is for binary ones.
These are going to be a lot longer and a lot more secure than an MD5 hash of a 128 bits
but for now, keep your eye on the binary and the MD5, and all I'm going to do is add one more character.
So add a 1 at the end and click hash again
and what you should have noticed is that the hash changed quite dramatically from the previous example.
Notice at the end here 0816,
when I put another character in and I'll just put in a dot click hash notice the entire number has
changed.
So even a minor change in the source text will cause the hash to change entirely.
So in other words, if you change your password, the whole hash changes.
So it's much more difficult for someone to try and crack this password than, say, using service password
encryption.
Cisco once again recommend that you use a secret password rather than an enable password.
Let's look at functionality of the password's, router 1 has an enable and secret password configured,
router 2 at the moment doesn't have a password configured.
I'll boot the router
and open up a console.
So type disable on router 1,
do the same on router 2, when I type enable on router 1, I need to enter my password, which is
my secret password on router 2, I don't have to enter anything because no password has been configured.
If I type in able.
And do nothing.
The right is going to wait for a period of time for me to enter a password, and if I don't, it's going
to prompt me.
I'll speed up the video to save you the time waiting for this.
But notice the time out has expired, that's going to happened three times while we waiting for that.
I'll set up an enabled password on Reddit to.
And I'll show you what happens when I touch the wrong password in, so I'm going to type in password
one password to possibly three notice, it tells me bad passwords.
So I'm not locked out of the router.
I'm simply told that I've entered a bad number of passwords, notice and write a one second time that
has occurred on router 2.
let's do enable secret Cisco 1 disable.
Now, this is going to be my secret password, 1, 2, 3, told bad secrets.
Previously, I was told bad passwords, on router 1 I'm told bad secrets because I've had three timeouts.
So the moral of the story is that if you wait too long, you'll be prompted again.
After three incorrect tries of a password, it reverts back to user mode and that's the default behavior
it's not going to lock you out of the router.
You can enable more security, but that's not covered in the CCNA course.
So won't explain it here
but you can lock someone out of a router if you want to.
Another thing to take note of is,
show run pipes include enable
you can't use this as your password, so I'll copy that and type disable
and paste it in, but it's not accepted as a password.
So I'll say no enable secret.
Show run pipes include enable, so my password is Cisco
type service password encryption
Show run pipe include enable, there's my encrypted password, I'll try and paste that in when prompted for
a password and it's not accepted.
I need to use my unencrypted password when going from user mode to enable mode.