For more information on document conventions, refer to the Cisco Technical Tips Conventions. User passwords and most other passwords not enable secret s in Cisco IOS configuration files are encrypted using a scheme that is very weak by modern cryptographic standards. Although Cisco does not distribute a decryption program, at least two different decryption programs for Cisco IOS passwords are available to the public on the Internet; the first public release of such a program of which Cisco is aware was in early We would expect any amateur cryptographer to be able to create a new program with little effort.
The scheme used by Cisco IOS for user passwords was never intended to resist a determined, intelligent attack. The encryption scheme was designed to avoid password theft via simple snooping or sniffing. It was never intended to protect against someone conducting a password-cracking effort on the configuration file.
Because of the weak encryption algorithm, it has always been Cisco's position that customers should treat any configuration file containing passwords as sensitive information, the same way they would treat a cleartext list of passwords.
The enable password command should no longer be used. Use the enable secret command for better security. The only instance in which the enable password command might be tested is when the device is running in a boot mode that does not support the enable secret command.
Enable secrets are hashed using the MD5 algorithm. As far as anyone at Cisco knows, it is impossible to recover an enable secret based on the contents of a configuration file other than by obvious dictionary attacks. Note: This applies only to passwords set with enable secret , and not to passwords set with enable password.
Indeed, the strength of the encryption used is the only significant difference between the two commands. Look at your boot image using the show version command from your normal operating mode Full Cisco IOS image to see whether the boot image supports the enable secret command.
If it does, remove enable password. If the boot image does not support enable secret , note the following caveats:. Setting an enable password might be unnecessary if you have physical security so that no one can reload the device to the boot image. If someone has physical access to the device, he can easily subvert the device security without needing to access the boot image.
If you set the enable password to the same as the enable secret , you have made the enable secret as prone to attack as the enable password. See random. SystemRandom for additional details. The secrets module provides functions for generating secure tokens, suitable for applications such as password resets, hard-to-guess URLs, and similar.
Return a random byte string containing nbytes number of bytes. If nbytes is None or not supplied, a reasonable default is used. Return a random text string, in hexadecimal. The string has nbytes random bytes, each byte converted to two hex digits. Return a random URL-safe text string, containing nbytes random bytes.
The text is Base64 encoded, so on average each byte results in approximately 1. To be secure against brute-force attacks , tokens need to have sufficient randomness. Unfortunately, what is considered sufficient will necessarily increase as computers get more powerful and able to make more guesses in a shorter period. As of , it is believed that 32 bytes bits of randomness is sufficient for the typical use-case expected for the secrets module.
That argument is taken as the number of bytes of randomness to use. Return True if strings a and b are equal, otherwise False , in such a way as to reduce the risk of timing attacks.
See hmac. This section shows recipes and best practices for using secrets to manage a basic level of security. Applications should not store passwords in a recoverable format , whether plain text or encrypted.
They should be salted and hashed using a cryptographically-strong one-way irreversible hash function. Generate a ten-character alphanumeric password with at least one lowercase character, at least one uppercase character, and at least three digits:.
Generate an XKCD-style passphrase :.
0コメント