A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Default Cisco devices have no passwords and welcome strangers. Every device you manage should be hardened before it touches production — passwords, banners, encrypted secrets, disabled unused services. This lesson is the minimum viable hardening for any IOS device.
! Enable secret (use 'secret', not 'password' — 'password' is reversible)R1-HQ(config)# enable secret S3cur3En@ble! Console line protectionR1-HQ(config)# line console 0R1-HQ(config-line)# password Cons0le!23R1-HQ(config-line)# loginR1-HQ(config-line)# exit! VTY lines for SSH/TelnetR1-HQ(config)# line vty 0 4R1-HQ(config-line)# password Vty!SecureR1-HQ(config-line)# loginR1-HQ(config-line)# transport input sshR1-HQ(config-line)# exit
`enable secret` uses a one-way hash — the password can't be recovered, only reset. `enable password` stores in near-plaintext and is trivially reversible. Never use `enable password`. If you see it in a config, replace it.
R1-HQ(config)# service password-encryption
This command obfuscates cleartext passwords in the config using a weak Cisco-proprietary algorithm (Vigenère-based, type 7). It stops casual shoulder-surfing of `show run` output — nothing more. Anyone with the algorithm can decode it in seconds. It's a speed bump, not encryption.
Do not rely on `service password-encryption` for real security. Use `enable secret` (type 5 or 8 hash), local users with `secret` (not `password`), and SSH-only VTY access. Type 7 encryption exists to slow down an attacker who's already on the device — not to stop one.
R1-HQ(config)# banner motd ^*** Authorized access only ***Unauthorized access is prohibited and will be prosecuted.Disconnect immediately if you are not an authorized user.^
The `^` is a delimiter — any character that doesn't appear in the banner text works. The banner appears before login, so it's the first thing a connecting user sees. Legally, this is important: in many jurisdictions, prosecuting unauthorized access requires you to have warned against it first.
`banner motd` shows before login. `banner login` shows after the MOTD but before authentication. `banner exec` shows after login. For most deployments, `banner motd` alone is sufficient — it's the legal warning that matters.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.