username privilege 15 (no aaa) without enable secret?

[Rogier]

Hi all,

I have some Cisco switches (C3560 Software C3560-IPBASE-M, Version 12.2(35)SE5).

On this I have configured a username with secret and privilege level 15.

Global is set to: "no aaa new-model".

On the console port and all vty ports I have set "login local".

Since I allways have to login with username, and this takes me to privilege level 15, my assumption is that I do not have to set an enable secret. Is this correct or do I still need to set "enable secret"?

Does it make a difference if I change to "aaa new model" and use global command "aaa authentication login default local" and set "loginauthentication default"to all lines (con + vty)?

Thanks a lot!

Rogier

[Dennis Mink · Accepted solution]

priv 15 will let you into enable mode without addition enable secret.

if you have no intention to use aaa, leave the service off. 

[Rogier]

Thanks for your reply.

Just to make sure: there is no risk of locking myself out in this scenario? And the lack of "enable secret" does not pose a security risk in this scenario?

[Reza Sharifi · Accepted solution]

Don't mess with AAA if you don't use it.

As for security risk, as long as your password is long and complicated enough, your security team should be ok with not having the "enable secret" command.

HTH

[Rogier]

Thanks a lot. Not using aaa, just want username + secret for all access!

So, username + secret in combination with "login local" should be fine for me.

[Reza Sharifi]

Yes, that should do it. 

Good Luck!