Worrisome command "no service password-recovery strict"

[ThomasKrizan6821]

Hello, recently I have stumbled upon the command "no service password-recovery strict" in the IOS XE documentation. According to the docs, this command disables any way of recovering access to the device in case AAA or enable password doesn't work, you can't even access ROMMON, which basically bricks the device. According to Cisco, the only way to unbrick the device is to send it to them and they will get it running again.

Recently, one of our routers got hacked, by mistake we left HTTPS running on one router and because of that it got exploited by the IOS XE WEB GUI vulnerability, which gave the hacker full priviliged access to the router. Fortunately we noticed quickly and in the end only configuration was stolen which is not the end of the world. However since I've seen the no service password-recovery strict command I've been thinking that the hacker could have potentionally applied this command on the compromised router, mess up our configuration and therefore bricking our router remotely and taking it out business for long period of time since I imagine it would take a long time to send it to Cisco and them to fix it and send it back.

Now this could still be saved because we can always replace this router with backup, but what if another privilige escalation vulnerability was discovered (I wouldn't be very surprised at this point) and someone used it to access all our IOS XE devices before we even knew about it, using this command they could brick every single vulnerable device without us having any way to unbrick it, which in the end would probably take our company out of business since our network would be down for a long period of time and we can't replace every device.

Were it not for this command, getting hacked like this would still be a catastrophe but at least we could get the network up and running again pretty quickly.

Am I right to dislike this "feature" and worry about it ? Is there some not widely known way to recover access to the device even if this command was applied ? I like to be prepared for everything, doesn't matter how unlikely it is to happen, but right now I have no idea how I would handle the situation were this to happen.

[M02@rt37]

Hello @ThomasKrizan6821 

As I know, there is no widely known, documented, or supported method to recover a device when the "no service password-recovery strict" command has been applied. The purpose of this command is to enhance security by making it extremely difficult to recover access to the device without physical access and assistance from Cisco.

Disabling password recovery mechanisms can indeed pose a risk, as it removes a safety net in case of accidental lockouts or compromises. If this command is applied and the access to the device is lost due to forgotten passwords or any other reason, the only way to recover the device is typically through Cisco's assistance.

[Leo Laohoo]

I have never been a fan of the command "no service password-recovery" and I'm fed up with people using the command without understanding the full repercussion as a result and then come begging on how perform a password-recovery.  

I, for one, have seen this command being abused and misused many times.  

Any thread that has "no service password-recovery" configured and asking for instruction(s) for password-recovery I always tell them to raise an RMA. 

Instead of "no service password-recovery", Cisco should "monetize" this and incorporate it into the licensing regime.

[M02@rt37]

Totally agree with you @Leo Laohoo !

[ThomasKrizan6821]

Totally agree with you, though I can understand the existence of no service password-recovery command, but not the variant with strict keyword, that feature is asking to be abused..

[Richard Burts]

"no service password-recovery" is pretty dangerous and adding the strict parameter makes it much more dangerous. Anyone thinking about using either of these needs to have a very good understanding of the implications (and should have existing procedures for dealing with it). And many of us have seen situations where someone implemented one without having that good understanding, and suffered the consequences. Cisco implemented these because there are some environments where the concern about intrusion/compromise is so great that they are willing to live with the consequences. So the point here is that if you are thinking about implementing one of these alternatives think very carefully about whether you are really in one of those very few environments.

[MHM Cisco World]

Recovering a Router with the Password Recovery Service Disabled - PacketLife.net

even if you disable this feature you can still recover
since that you dont need to disable it 
MHM

[M02@rt37]

@MHM Cisco World 

2010 article... and depend of the platform, this procedure could not work.

[MHM Cisco World]

User Security Configuration Guide, Cisco IOS Release 15SY - No Service Password-Recovery [Support] - Cisco

friend read this also
it only headache.
so I recommend not to disable it.
MHM 

[M02@rt37]

@MHM Cisco World 

I'm agree! so I recommend not to disable it, at all !

[ThomasKrizan6821]

If I understand it correctly, you cannot send break signal while the router is booting when command no service password-recovery strict is used (keyword strict is important) so this recovery process wouldn't work, I can't test it since I don't want to apply this command on my routers but it seems you wont even get the prompt to reset the router to factory settings. 

[MHM Cisco World]

What is platform you have ?

MHM

[ThomasKrizan6821]

We use mostly ISR C11xx with IOS XE 17.6.5a. 

[Ruben Cocheno]

@ThomasKrizan6821 

Unless you have that "no recovery" requirement in writing by your client so he understands the nefast consequences then you good.

The consequences of that command are really