User Mode and Privileged Mode Security

[lagapidis (Lazarus Agapidis)]

Hello Louis

@louis1

I tried again configuring the secret 5 with a username using your instructions, and I can SSH successfully from another device now – not sure what went wrong last time.

Good to hear that it’s working!

@louis1

I tried the stronger encryption method mentioned by Rene in the article, however the commands don’t exist on the router I’m using, so I assume it requires a newer IOS version.

Yes, both types 8 and 9 (SHA-256 and scrypt respectively) are supported starting from IOS 15.3(3).

@louis1

According to the Cisco document you linked, the secret 5 can be cracked but would take a long time – therefore I assume it’s “good enough” to use in a production environment. Would that be correct?

When you choose the type of encryption you should take into account what other security measures are in place. Do you have an access list that limits connectivity on the management interfaces? Any Control Plane Policing? Management Plane Protection? Is the device accessible only from the local network or from the Internet? If there are other measures in place, then type 5 would most likely be “good enough” as you say. If your device is accessible via the Internet, or is in an environment where you don’t have absolute control over who is able to connect, then using a better encryption method may be beneficial.

@louis1

Also with the secret 5, I noticed we cannot set permissions levels (1-15) like we can with the old passwords. With the secret 5 are these permissions levels obsolete? Do we need to just use the “enable secret” as well to provide full permissions?

The privilege level can be set using commands similar to the following:

R1(config)#username laz privilege 15 secret my_password

I was able to enter this command on a Cisco router and set the privilege level to 15. I then tried to connect to R1 using telnet, and I was able to log in with these credentials. When I did, I was put immediately into privileged executive mode, which is this prompt: R1#

If I didn’t set the privilege to 15, then it would give me user executive mode which is this prompt: R1>. In order to get to privileged executive mode, I would then need to issue the enable command and the corresponding password.

I hope this has been helpful!

Laz