The network element must be configured to ensure passwords are not viewable when displaying configuration information.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3062	NET0600	SV-41449r2_rule	ECSC-1	High

Description
Many attacks information systems and network elements are launched from within the network. Hence, it is imperative that all passwords are encrypted so they cannot be intercepted by viewing the console or printout of the configuration.

STIG	Date
Infrastructure Router Security Technical Implementation Guide Cisco	2016-07-07

Details

Check Text ( C-39960r6_chk )
Review all Cisco IOS routers and switches to determine if the global command "service password-encryption" is present in the configurations. Also, review all accounts created on the device to ensure they have been setup using the "username name secret password" command. The following command will be found in the device configurations Device# show run ! service password-encryption ! username name secret 5 $1$geU5$vc/uDRS5dWiOrpQJTimBw/ enable secret 5 $1%mer9396y30d$FDA/292/

Check Text ( C-39960r6_chk )

Review all Cisco IOS routers and switches to determine if the global command "service password-encryption" is present in the configurations.

Also, review all accounts created on the device to ensure they have been setup using the "username name secret password" command. The following command will be found in the device configurations

Device# show run
!
service password-encryption
!
username name secret 5 $1$geU5$vc/uDRS5dWiOrpQJTimBw/
enable secret 5 $1%mer9396y30d$FDA/292/

Fix Text (F-40534r1_fix)
Configure the network element to ensure passwords are not viewable when displaying configuration information. Device(config)# service password Device(config)# username name secret S3cr3T! Device(config)# enable secret $MyS3cr3TPW$ Device(config)# end