topic Re: Keys do not change from clear text to key 6th in Network Security

Keys do not change from clear text to key 6th

EdouardZorrilla0939 — Sun, 05 Sep 2021 15:57:41 GMT

Greetings Gents,

I have this IOS 15.2(7)E3 running on 2960X.

I have set:

(config)#key config-key password-encrypt ***

(config)#password encryption aes

However, my tacacs and radius keys do not get encrypted using 'key 6', like in this example. They are still shown in clear-text.

Configure the Encrypt Pre-shared Keys in Cisco IOS Router - Cisco

Could you please advise what else I am missing.

Thanks,

Edouard.

Re: Keys do not change from clear text to key 6th

Milos_Jovanovic — Mon, 06 Sep 2021 06:02:31 GMT

Hi @EdouardZorrilla0939,

I believe you'll need command 'service password-encryption' (although I don't have switch next to me to be sure). Also, if I remember correctly, it might not be that this command will encrypt your already configured password, and that you'll have to retype them.

What I do remember is that you need to remember/save password used in 'key config-key password-encrypt XXX', as you won't be able to restore configuration later without it (in terms of password recovery).

BR,

Milos

Re: Keys do not change from clear text to key 6th

EdouardZorrilla0939 — Mon, 06 Sep 2021 07:02:05 GMT

Hi Milos,

The password-type 7 is weak, and I am looking to use password-type 6 using AES as encryption.

tacacs server ABC
address ipv4 1.1.1.1
key cisco123

I need to encrypt the tacacs's key in our 2960x, but I can't.

I will open a ticket with Cisco TAC tomorrow.

Regards,

Edouard.

Re: Keys do not change from clear text to key 6th

Marvin Rhoads — Mon, 06 Sep 2021 14:31:15 GMT

I believe you need to use the command " tacacs server key 6 key-name."

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-2_7_e/release_notes/rn-1527e-2960x-xr.html

Re: Keys do not change from clear text to key 6th

EdouardZorrilla0939 — Tue, 07 Sep 2021 15:24:23 GMT

Hi Marvin,

Thanks for sharing this information. I have the following IOS version:

Cisco IOS Software, C2960X Software (C2960X-UNIVERSALK9-M), Version 15.2(7)E3, RELEASE SOFTWARE (fc3)

However, the command syntax " tacacs server key 6 key-name." is not available.

Best regards,

Edouard.

Re: Keys do not change from clear text to key 6th

Marvin Rhoads — Wed, 08 Sep 2021 18:14:36 GMT

That's odd. It should work according to the documentation. Can you open a TAC case on it?

Re: Keys do not change from clear text to key 6th

radics.tibor1974 — Fri, 17 Sep 2021 07:36:17 GMT

Hello guys. I can confirm, it doesnt work.

I created a master key, then encrypted them via aes - at least tried to - but the clear text stays . Copy doesnt work too, although the same master key is used.

Has somebody already opened a TAC case. I´m really tired about open new cases, I already have some regarding other issues 😞

Re: Keys do not change from clear text to key 6th

EdouardZorrilla0939 — Fri, 17 Sep 2021 16:08:39 GMT

I've opened a case with Cisco TAC and I will update you guys when I have meaningful information.

Re: Keys do not change from clear text to key 6th

Chris345 — Fri, 15 Sep 2023 20:17:27 GMT

Did you end up getting a response, I'm looking to do the same? That is to move my weak 7 type passwords in the tacacs server commands to type 6.