What characters are illegal in Cisco IOS username secret passwords?
- by Alain O'Dea
I am using username secret to add users with encrypted passwords to our switches and firewall.
I have been battling with the same switches and firewall for a couple of hours trying to get securely generated hard passwords for all admins. Sometimes, the passwords would go into config, but wouldn't work for login.
According to the documentation for enable secret a password must not begin with a number and ? has to be entered as Ctrl-V then ? to escape it.
I followed that and still got passwords I could not use sometimes. There was no error when I ran username, but the password would be rejected on login by some, but not all of the switches. They are all WS-C2960-48PST-L. The passwords it didn't like contained back ticks "`" (that character under tilde ~ under Esc).
The "misbehaving" switches are running:
Cisco IOS Software, C2960 Software (C2960-LANBASEK9-M), Version 12.2(50)SE5, RELEASE SOFTWARE (fc1)
The "working" switches are running:
Cisco IOS Software, C2960 Software (C2960-LANBASEK9-M), Version 12.2(46)SE, RELEASE SOFTWARE (fc2).
The "misbehaving" switches are running a newer IOS, so this suggests a regression introduced somewhere between 12.2(46)SE and 12.2(50)SE5. I was unable to find any evidence of this being intentional in the release notes for 12.2(50)SE.
I would like to avoid this next time the passwords are changed :)
What characters are illegal in Cisco IOS username secret passwords?
Thank you for your help :)
