Cisco IOS Password Security Checklist
A working, field-tested checklist for network and security engineers auditing password hygiene across Cisco IOS and IOS-XE devices — with the actual commands to check each item.
1. Device-Level Basics
enable secret is set (Type 8 or 9), and enable password is fully removed, not just superseded
service password-encryption is enabled as a baseline safety net for any remaining plaintext line passwords
Commands to check this
Run these directly on the device to check the state of each item above:
The last command dumps every line con, line aux, and line vty block so you can review password/login settings for each in one pass.
2. Local Accounts & AAA
username line uses secret (hashed), never bare password
Commands to check this
Look for any username ... password ... line (bare password, no secret keyword, no algorithm-type) — that's a plaintext or Type 7 local account and should be migrated immediately.
3. Config Hygiene
public/private), and SNMPv3 is used instead of v1/v2c where possible
Commands to check this
Run on the device to review SNMP community strings. To sweep multiple config backups from your workstation for weak password types at once (not a Cisco command — this runs in your regular terminal against downloaded config files):
4. Quarterly Review Cadence
Most of the items above aren't "set once and forget" — they drift as staff change and devices get replaced. A workable cadence for most teams:
| Frequency | What to review |
|---|---|
| Monthly | Review AAA logs for logins from local (non-TACACS/RADIUS) accounts — these should be rare and explainable |
| Quarterly | Re-run the config sweep for weak password types across all backed-up configs; reconcile the local account list against current staff |
| Annually, or after major staffing changes | Rotate the enable secret and any shared local-account credentials; re-verify console/AUX physical access controls |