Cisco IOS Password Security: A Working Checklist
A working checklist for network and security engineers auditing password hygiene across Cisco IOS and IOS-XE devices, with the actual commands to check each item.
1. Device-Level Basics
enable secret is set (Type 8 or 9), and enable password is fully removed, not just superseded
service password-encryption is enabled as a baseline safety net for any remaining plaintext line passwords
Commands to check this
Run these directly on the device to check the state of each item above:
The last command dumps every line con, line aux, and line vty block so you can review password/login settings for each in one pass.
2. Local Accounts & AAA
username line uses secret (hashed), never bare password
Commands to check this
Look for any username ... password ... line (bare password, no secret keyword, no algorithm-type) — that's a plaintext or Type 7 local account and should be migrated immediately.
3. Config Hygiene
public/private), and SNMPv3 is used instead of v1/v2c where possible
Commands to check this
Run on the device to review SNMP community strings. To sweep multiple config backups from your workstation for weak password types at once (not a Cisco command — this runs in your regular terminal against downloaded config files):
4. Quarterly Review Cadence
Most of the items above aren't "set once and forget" — they drift as staff change and devices get replaced. A workable cadence for most teams:
| Frequency | What to review |
|---|---|
| Monthly | Review AAA logs for logins from local (non-TACACS/RADIUS) accounts — these should be rare and explainable |
| Quarterly | Re-run the config sweep for weak password types across all backed-up configs; reconcile the local account list against current staff |
| Annually, or after major staffing changes | Rotate the enable secret and any shared local-account credentials; re-verify console/AUX physical access controls |
5. Remote Access and the Management Plane
transport input ssh), and Telnet is disabled everywhere it can be
access-class) limits which addresses can even try to log in
exec-timeout, and repeated failures are slowed down with login block-for
no ip http server, no ip http secure-server)
Commands to check this
The first command shows transport, access class and timeout for each VTY line. The second shows whether the web server is on. The third confirms that SSH is enabled and which version it runs. A lockout control looks like this:
This blocks further logins for 120 seconds after three failures within 60 seconds, and logs both outcomes. Exempt your management network with a login quiet-mode access-class list so that an attacker cannot lock administrators out. See how to configure SSH for the full setup.
6. Logging and Evidence
Without reliable logs, you cannot tell whether a leaked password was ever used. Set this up with syslog and NTP, and monitor devices over SNMPv3 rather than v1 or v2c.
Common Findings and What to Do About Them
| Finding | Why it matters | Fix |
|---|---|---|
enable password 7 ... | Readable by anyone who sees the config | Set an enable secret and remove the old line |
username ... password ... | Plaintext or Type 7 local account | Recreate the user with secret |
| Telnet allowed on VTY lines | Credentials cross the network in clear text | Use transport input ssh |
| Default SNMP communities | Anyone can read device data | Move to SNMPv3 and remove the old strings |
| Open AUX or console line | Physical or out-of-band backdoor | Require login on every line |
Fix the items that expose credentials first, then the ones that widen who can reach the device. Record the date of each change so the next review can start from known ground.
Summary
Password security on Cisco devices is a set of habits: strong stored credentials, central accounts with a break-glass fallback, SSH-only remote access limited by address, clean backups, and logs you can trust. Work through the six groups above, record the result per device, and repeat on the schedule in section 4.