Cisco WS-SUP32-GE-3B Software Configuration Guide - Page 61

Chapter 3 Configuring the Switch for the First Time Protecting Access to Privileged EXEC Commands Using the enable password and enable secret Commands To provide an additional layer of security, particularly for passwords that cross the network or that are stored on a TFTP server, you can use either the enable password or enable secret commands. Both commands configure an encrypted password that you must enter to access enable mode (the default) or to access a specified privilege level. We recommend that you use the enable secret command. If you configure the enable secret command, it takes precedence over the enable password command; the two commands cannot be in effect simultaneously. To configure the switch to require an enable password, perform either of these tasks: Command Router(config)# enable password [level level] {password | encryption-type encrypted-password} Router(config)# enable secret [level level] {password | encryption-type encrypted-password} Purpose Establishes a password for the privileged EXEC mode. Specifies a secret password, saved using a nonreversible encryption method. (If enable password and enable secret commands are both set, users must enter the enable secret password.) Use either of these commands with the level option to define a password for a specific privilege level. After you specify the level and set a password, give the password only to users who need to have access at this level. Use the privilege level configuration command to specify commands accessible at various levels. If you enable the service password-encryption command, the password you enter is encrypted. When you display it with the more system:running-config command, it displays in encrypted form. If you specify an encryption type, you must provide an encrypted password that you copy from another Catalyst 6500 series switch configuration. Note You cannot recover a lost encrypted password. You must clear NVRAM and set a new password. See the "Recovering a Lost Enable Password" section on page 3-18 if you lose or forget your password. To display the password or access level configuration, see the "Displaying the Password, Access Level, and Privilege Level Configuration" section on page 3-18. Setting or Changing a Line Password To set or change a password on a line, perform this task: Command Router(config-line)# password password Purpose Sets a new password or change an existing password for the privileged level. To display the password or access level configuration, see the "Displaying the Password, Access Level, and Privilege Level Configuration" section on page 3-18. OL-11439-03 Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY 3-15