Cisco WS-SUP32-GE-3B Software Configuration Guide - Page 62

Protecting Access to Privileged EXEC Commands Chapter 3 Configuring the Switch for the First Time Setting TACACS+ Password Protection for Privileged EXEC Mode For complete information about TACACS+, refer to these publications: • Cisco IOS Security Configuration Guide, Release 12.2, "Authentication, Authorization, and Accounting (AAA)," at this URL: http://www.cisco.com/en/US/docs/ios/12_2/security/configuration/guide/scfaaa.html • Cisco IOS Security Command Reference, Release 12.2, at this URL: http://www.cisco.com/en/US/docs/ios/12_2/configfun/command/reference/ffun_r.html To set the TACACS+ protocol to determine whether or not a user can access privileged EXEC mode, perform this task: Command Router(config)# enable use-tacacs Purpose Sets the TACACS-style user ID and password-checking mechanism for the privileged EXEC mode. When you set TACACS password protection at the privileged EXEC mode, the enable EXEC command prompts for both a new username and a password. This information is then sent to the TACACS+ server for authentication. If you are using the extended TACACS+, it also sends any existing UNIX user identification code to the TACACS+ server. Caution If you enter the enable use-tacacs command, you must also enter tacacs-server authenticate enable, or you are locked out of the privileged EXEC mode. Note When used without extended TACACS, the enable use-tacacs command allows anyone with a valid username and password to access the privileged EXEC mode, creating a potential security problem. This problem occurs because the switch cannot tell the difference between a query resulting from entering the enable command and an attempt to log in without extended TACACS. Encrypting Passwords Because protocol analyzers can examine packets (and read passwords), you can increase access security by configuring the Cisco IOS software to encrypt passwords. Encryption prevents the password from being readable in the configuration file. To configure the Cisco IOS software to encrypt passwords, perform this task: Command Router(config)# service password-encryption Purpose Encrypts a password. Encryption occurs when the current configuration is written or when a password is configured. Password encryption is applied to all passwords, including authentication key passwords, the privileged command password, console and virtual terminal line access passwords, and Border Gateway Protocol (BGP) neighbor passwords. The service password-encryption command keeps unauthorized individuals from viewing your password in your configuration file. 3-16 Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY OL-11439-03