AAA - secret

Having some AAA crisis.

Please help me clrafiy somethings.

"enable secret level 5 abc" means pw "abc" for level 5 access?

"enable secret 5 abc" means pw "abc" with md5 hashed form?
Some textbook examples show "enable sercert 5 @38diL?1i2jfSS" but how can a human being enter in hashed format?
or does the CLI automtically convert the command input?

But then when I do "run config" after I hit above command, would I see "enable sercert 5 @38diL?1i2jfSS" ?

Lastly, if I do a "debug" on localDB aaa later on, would the only the password matter? since there is no username?

(If you could cite a published source upon answering, I'd greatly apprecieate it).

Thanks.

Find more posts tagged with

Comments

RouteMyPacket

sendalot wrote: »

Having some AAA crisis.

Please help me clrafiy somethings.

"enable secret level 5 abc" means pw "abc" for level 5 access?

Correct

"enable secret 5 abc" means pw "abc" with md5 hashed form?
Some textbook examples show "enable sercert 5 @38diL?1i2jfSS" but how can a human being enter in hashed format? or does the CLI automtically convert the command input?

If you are pasting in a hashed password from another device perse, this is where "5" comes in. Do an "enable secret ?" to learn more on this.

But then when I do "run config" after I hit above command, would I see "enable sercert 5 @38diL?1i2jfSS" ?

If you entered it hashed with the "5" yes, if you did a normal "enable secret password123" it would return hashed off a sh run if you had service password-encryption enabled

Lastly, if I do a "debug" on localDB aaa later on, would the only the password matter? since there is no username?

(If you could cite a published source upon answering, I'd greatly apprecieate it).

Published resource = my brain

Thanks.

In bold above

sendalot

so do "enable secret" have a username tied to it?
i thought it has no username tied to it and that's why when we do "enable," it doesn't ask for a username?

Thanks.
(PS: that's a great source!)

RouteMyPacket

No, enable secret and local database are two seperate things

sendalot

I guess at ICND R&S scope, it's enable secret. But when we are talking AAA, there always are usernames tied to the pw?

RouteMyPacket

During AAA, we are leveraging..well...a AAA server. Say for instance ACS and should the TACACS server be unavailable, we would want to leverage the local database username/password so we could get into our gear.

enable secret password123

username sendalot priv 15 secret password123

Also, when you want to login to your gear, configure the vty line to allow local login.