topic enable password and enable secret in Network Security

enable password and enable secret

vishalpatil86 — Fri, 21 Feb 2020 12:34:45 GMT

whats the difference between enable password and enable secret?

does secret encrypt the password we have given?

Re: enable password and enable secret

Leo Laohoo — Thu, 01 Mar 2012 03:26:12 GMT

does secret encrypt the password we have given?

Passwords will be encrypted if you use the command "service password-encryption".

whats the difference between enable password and enable secret?

Password will take prescedence over secret.

Re: enable password and enable secret

ninoroygaleos — Mon, 05 Mar 2012 08:24:52 GMT

Hi vishal patil,

The difference is that,

# enable password - it will enables a password that based on a clear text, unlike,

# enable secret - it will enables a password and password encryption that based on the md5 hashing algorithm. This is is a most recommended command to supply while enabling a password to any cisco network devices.

-onin.

Re: enable password and enable secret

Diomedes — Tue, 24 Mar 2020 23:08:19 GMT

Old post I know, but just wanted to make sure this was corrected in case anyone else stumbles on this answer as I have. It's the other way around. Secret overrides password.

Re: enable password and enable secret

vlausell — Sun, 19 Mar 2023 23:02:53 GMT

Interesting, but apparently its good practice to use secret bc of higher encryption. Thanks

I kept wondering why use both.

Re: enable password and enable secret

IT_Joe — Fri, 27 Oct 2023 19:26:52 GMT

Cisco had enable password to store passwords for the use of privileged EXEC commands by console or remote (vty) users. These passwords were stored as clear-text in the configuration, and could be read by anyone calling show running-config.

Cisco then implemented service password-encryption to store these passwords as a different combination of characters using an algorithm. These are the passwords of type "7". This was still insecure: Googling "cisco password decryption" will yield websites that will decrypt type 7 passwords.

Finally, Cisco came up with enable secret which hashes the passwords with an MD5 algorithm. The only way to find the original passwords would be through the use of a rainbow table, and even that is unlikely as more than two character strings may return the same MD5 hash.

Re: enable password and enable secret

diduarte — Wed, 20 Mar 2024 17:57:56 GMT

According Cisco documentation is the opposite.

If you configure the enable secret command, it takes precedence over the enable password command; the
two commands cannot be in effect simultaneously.
If you enable password encryption, it applies to all passwords including username passwords, authentication
key passwords, the privileged command password, and console and virtual terminal line passwords

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9200/software/release/16-10/configuration_guide/sec/b_1610_sec_9200_cg/controlling_switch_access_with_passwords_and_privilege_levels.pdf