Information
When password encryption is enabled, the encrypted form of the passwords is displayed when a more system:running-config command is entered.
Rationale:
This requires passwords to be encrypted in the configuration file to prevent unauthorized users from learning the passwords just by reading the configuration. When not enabled, many of the device's passwords will be rendered in plain text in the configuration file. This service ensures passwords are rendered as encrypted strings preventing an attacker from easily determining the configured value.
Solution
Enable password encryption service to protect sensitive access passwords in the device configuration.
hostname(config)#service password-encryption
Impact:
Organizations implementing 'service password-encryption' reduce the risk of unauthorized users learning clear text passwords to Cisco IOS configuration files. However, the algorithm used is not designed to withstand serious analysis and should be treated like clear-text.
Default Value:
Service password encryption is not set by default
References:
http://www.cisco.com/en/US/docs/ios-xml/ios/security/s1/sec-cr-s1.html#GUID-CC0E305A-604E-4A74-8A1A-975556CE5871
Notes:
Caution: This command does not provide a high level of network security. If you use this command, you should also take additional network security measures.
Note: You cannot recover a lost encrypted password. You must clear NVRAM and set a new password.