Lessons · Network switches · the secrets that do not travel

The secrets that travel, and the one that does not

Password hashes and usernames are lines in the configuration and come across. The crypto key is not a line and does not.

Hone is a place to practise programming. This is one of its lessons, written out in full and free to read without an account.

What it is for

It is why a restored switch is fully configured for a protocol it cannot yet speak, and it is why the backup file is sensitive: the hashes went to the server with everything else.

How to think about it

Regenerate the key on the new box, and rotate the enable secret after a swap -- the old hash has just been written to a file and read by whoever did the work.

Worked example

enable

In.

configure terminal

The credentials.

hostname IDF6

A key needs a hostname other than the default.

enable secret Comms-Room-4

This is a line in the configuration, so it travels.

username swapadmin secret Handover-9

So does this.

ip domain-name works.local

And this.

crypto key generate rsa

This is not, and does not.

end

Out.

show running-config | include secret

Both secrets are in the file that goes to the server.

Your turn

Set the privileged-mode password so it is stored hashed.

enable  Comms-Room-4

The trap

Leaving the enable secret alone after a swap. Nothing is broken, which is exactly why it gets skipped.

Practise the secrets that do not travel on HoneA question on it now, a coding challenge where there is one, and it is remembered for review. Free, no email needed.