topic Re: Tacacs key encryption in Network Access Control

Tacacs key encryption

keith0001111111 — Fri, 21 Feb 2020 18:57:50 GMT

I am trying to improve the security of some of our switches, one of the things I want to do is change all the tacacs keys from encryption level from type 7 to type 6 (aes).

some of the switches have the option by default for "tacacs-server key 6 password" where as other switches only have option 0 and 7 for encryption level.

Even when I enable aes "password encryption aes" and set the aes encryption key "key config-key password-encrypt TestPassword" I still dont get option 6 for my encryption level

This is on Version 15.2(4r)E3.

I have the same issue with some other catalyst switches as well.

can anyone advise if only some firmware versions support this level of encryption or if I'm missing something

thanks,

Keith

Re: Tacacs key encryption

ashstavegas — Thu, 07 Jun 2018 22:09:50 GMT

Hi. I also am looking for a workaround for this. Be interested to hear what the community has done with this. Google didn't find anything!

Re: Tacacs key encryption

perkin — Wed, 17 Apr 2019 11:19:48 GMT

Hello Keith

actually, I have a similar problem recently,
I do some google and cisco community and seems I found the solution on this and the reason I may not adopt this type6
1) why I may not try AES 256
it seems that AES needs to encrypted by the master key, which means that you cannot just copy the config and pasted to others device.
so that might be the problem even enable secret is not using type 6 but type 9 for more secure password you can copy.

2) the implementation,

seems that using key chain concept by encrypted an AES key before you applied on the tacacs key command

although the example is isakmp, with a reasonable guess the logic is the same I believe.

Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#key config-key password-encrypt testkey123
Router(config)#password encryption aes
Router(config)#^Z
Router#
Router#show running-config
Building configuration...
.....
password encryption aes
...
crypto isakmp policy 10
authentication pre-share
crypto isakmp key 6 FLgBaJHXdYY_AcHZZMgQ_RhTDJXHUBAAB address 10.1.1.1

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/46420-pre-sh-keys-ios-rtr-cfg.html

https://community.cisco.com/t5/security-documents/why-you-should-be-using-scrypt-for-cisco-router-password-storage/ta-p/3157196