Practice
In this example we set the password MySuperPassword for entering configuration mode (for the enable command) and the password UsersPassword for the user mylogin.
Accordingly, instead of mylogin you need to substitute the username for which you want to change the password.
Accordingly, you can also change not both passwords, but only one of them (either for enable or for the user), or change the password for any user you want.
Changing a user's password on an ASA via Cisco ASDM 5.1: Configuration -> Properties -> Device Administration -> User Accounts, select the user, click the Edit button.
enable secret - the password for entering enable mode (privileged mode), which is stored on the router in encrypted form.
enable password - the same thing, but stored in unencrypted form.
virtual terminal password - the virtual terminal password, or Telnet password. If it is set, then any user trying to access the router via the Telnet protocol will be required to enter this password.
Now about the main operations with users and authorization.
The command deletes the account oldusername:
no username oldusername
The command creates a new account:
username ciadmin privilege 15 secret NEWPASSWORD
The command changes the password for an existing account, while the privilege level remains unchanged:
username ciadmin secret NEWPASSWORD
The following command changes the enable mode password. Instead of enable secret you can specify enable password, which is the same thing, but the password is stored in unencrypted form:
enable secret NEWPASSWORDSECRET
The following two lines enable authorization by login and password before entering the enable password. The second line enables the local authentication method, which uses the aaa database.
aaa new-model//enables the aaa access control model aaa authentication login default local
The following command makes it possible to enter privileged mode immediately after logging in over the network, without typing the enable command (the manual states this somewhat unclearly - "initiates authorization to determine if the user is allowed to run an EXEC shell").
aaa authorization exec default local
When these three lines are present in the configuration (aaa new-model, aaa authentication login default local, aaa authorization exec default local), entering enable mode over a network connection will only prompt for the user's login and password (you need to enter the login and password of a user with privilege level 15); if you connect via the console port (RS232), you additionally need to enter the enable keyword and the enable secret password. If these 3 lines are not specified, then to enter privileged mode via the console it is enough to enter only the login and password of a user with level 15.
Here the password for the vpn client is changed (group vpnaccess):
tunnel-group vpnaccess ipsec-attributes pre-shared-key *
The command that shows enable passwords in the config in (open)encrypted form:
(no) service password-encryption
Comments