Enable 'service password-encryption'

HighLevel 1Automatedcisco-ios

Description

When password encryption is enabled, the encrypted form of the passwords is displayed when a more system:running-config command is entered. This requires passwords to be encrypted in the configuration file to prevent unauthorized users from learning the passwords just by reading the configuration. Audited against the output of 'show running-config' (run 'terminal length 0' first; do not use 'show running-config all' or 'show startup-config').

How it is checked

Audit method: Configuration pattern

Pattern: (?m)^service password-encryption\s*$

How it is fixed

Fix method: Guidance or infrastructure patch

! Enable password encryption service to protect sensitive access passwords in the device configuration. service password-encryption

Properties

Operating systems: Any
Tags: cisco-iosnetworkaaa
Reference: CIS Cisco IOS XE 17.x Benchmark v2.2.1 - 1.4.2 Enable 'service password-encryption'

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target cisco-ios