topic Re: IOS Password Encryption Algorithm in Network Security

IOS Password Encryption Algorithm

avilt — Fri, 21 Feb 2020 15:53:26 GMT

I need to implement strong encryption algorithm for Cisco IOS and ASA firewalls. How do I achieve this?

Re: IOS Password Encryption Algorithm

Marvin Rhoads — Sun, 17 Jun 2018 07:25:19 GMT

It sounds like, from this question and the other one you posted, that you've been audited or are preparing for an audit. It would be better if you learned some of the fundamentals and best practices rather than asking specific questions out of context.

In any event, ASA passwords since 9.7 can use a stronger pbkdf2 algorithm for hashing local passwords. Details are here:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/configuration/general/asa-99-general-config/aaa-local.html#ID-2114-00000076

IOS devices should be setup to use type 9 (where possible - vs. type 5 or 7) user passwords and "enable secret" passwords. If type 8/9 are not supported on your IOS then type 5 is the next-preferred method.

https://learningnetwork.cisco.com/thread/86911

Re: IOS Password Encryption Algorithm

avilt — Mon, 18 Jun 2018 06:04:47 GMT

When I define users on IOS/ASA, is it possible to hide/encrypt the username in the running config?

username Abc privilege 15 secret 5 $XXXXXXXXXXXXXXXXXXXXXXXXX

Re: IOS Password Encryption Algorithm

Rob Ingram — Mon, 18 Jun 2018 12:14:46 GMT

Hi, I don't believe it's possible to hide/encrypt a local user account in the running configuration.

What a lot of organizations do is implement an external aaa server (tacacs+ or radius) which stores the user accounts/passwords in a remote database (therefore not stored on the local router/switch).