How to hide an encrypted password in config

[marcusbrutus]

Hi,

I need someone's expert opinion.

Is there a way to hide (make blank) the password whenever i run a show run or show start for example.

I have gone through a lot of articles and so far no one has an answer apart from using EEM.

I believe i have seen this done by managed router services wherein they just allow the show config command and the password is missing.

I tried using EEM but majority of our IOS do not support the "action 1.3 put" command in EEM.

Thanks in advance for any assistance.

[sdheer]

Hi ,

If the only intent is hiding the password using  show run  ,then you can use   "show run | exclude enable | password"

This should remove the lines including enable and password on the configuration

For running EEM script ,ipservices license is required .

Unforunately i do not know the EEM script to be used for the same.

Regards,

Swati

[marcusbrutus]

Hi Swati,

The purpose is to allow other users to do a show run but with the password omitted.  The command you recommended is exactly the cli action i have in place using EEM.  Only, my EEM does not support the action put command which is necessary to allow the result to show on the terminal.

Nevertheless, thanks for offering advice.

[milan.kulik]

Hi,

I'm afraid  "to allow other users to do a show run but with the password omitted" wouldn't work.

I tried to allow "sh run" to users with privilege 5 in the past and it did not work, as IOS is permitting the users to see only that parts of running config which they are permitted to change.

"Sh start" works even for users with low privileges. But still I don't know any easy way how to remove the passwords completely.

What kind of passwords do you want to hide?

Wouldn't

service password-encryption

enable secret

user ... secret

be enough?

One idea:

sh tech-support | beg running-config

would show the running config with passwords removed.

But followed with hundreds lines of additional info.

And I'm also not sure if similar problem like that one I met with the "sh run" issued by low priority users would not occur.

HTH,

Milan

[marcusbrutus]

Hi Milan,

Sorry i meant show config.  I wish to provide certain users with the option to do a sh config with the passwords omitted.

sh run and show start are both unavailable unless explicitly allowed via privilege exec.

The thing is, i actually have seen similar to this done where if i do a show config, parts of the data is replaced with something like *omitted* and stuff.

[marcusbrutus]

I believe EEM is the only option using the replace and string functions which my IOS doesn't have.

Thanks anyway to all for helping.