Password7Decrypt

Cisco IOS Password Security Checklist

A working, field-tested checklist for network and security engineers auditing password hygiene across Cisco IOS and IOS-XE devices — with the actual commands to check each item.

1. Device-Level Basics

enable secret is set (Type 8 or 9), and enable password is fully removed, not just superseded
service password-encryption is enabled as a baseline safety net for any remaining plaintext line passwords
No device still has a factory-default or vendor-documented default credential active
Console, AUX, and VTY lines all require a password — an open AUX port is a classic overlooked backdoor

Commands to check this

Run these directly on the device to check the state of each item above:

show running-config | include enable secret
show running-config | include enable password
show running-config | section line

The last command dumps every line con, line aux, and line vty block so you can review password/login settings for each in one pass.

2. Local Accounts & AAA

Every username line uses secret (hashed), never bare password
Centralized AAA (TACACS+/RADIUS) is used for production access instead of relying solely on local accounts, so individual logins can be audited and revoked without touching every device
Local accounts are kept as a documented break-glass fallback only, with credentials stored in a password manager, not memorized or shared over chat
Stale accounts for former employees or contractors are removed, not just disabled

Commands to check this

show running-config | include username
show running-config | include aaa

Look for any username ... password ... line (bare password, no secret keyword, no algorithm-type) — that's a plaintext or Type 7 local account and should be migrated immediately.

3. Config Hygiene

Config backups (TFTP/SCP exports) are stored somewhere access-controlled, not on an open file share
SNMP community strings are not left at defaults (public/private), and SNMPv3 is used instead of v1/v2c where possible
No plaintext passwords appear anywhere in configs pasted into ticketing systems, chat, or documentation wikis
A periodic sweep of config backups for weak password types is run — see our legacy config audit guide for a repeatable process

Commands to check this

show running-config | include snmp-server community

Run on the device to review SNMP community strings. To sweep multiple config backups from your workstation for weak password types at once (not a Cisco command — this runs in your regular terminal against downloaded config files):

grep -E "password (5|7) " *.cfg

4. Quarterly Review Cadence

Most of the items above aren't "set once and forget" — they drift as staff change and devices get replaced. A workable cadence for most teams:

FrequencyWhat to review
Monthly Review AAA logs for logins from local (non-TACACS/RADIUS) accounts — these should be rare and explainable
Quarterly Re-run the config sweep for weak password types across all backed-up configs; reconcile the local account list against current staff
Annually, or after major staffing changes Rotate the enable secret and any shared local-account credentials; re-verify console/AUX physical access controls
Tip: Track this checklist in whatever ticketing/compliance system your team already uses, with a due date per item — a checklist that isn't scheduled tends not to get revisited until an audit forces it.