I'm university student studying for my certification exam, and I was doing some reviewing today when I found a question that I can't find an answer to. Basically, in the CCNA3 2.4.1 Cisco Netacademy online materials, it talks about encrypting passwords in the config. To quote the materials:
The encryption standard used by the service password-encryption command is referred to as type 7. This encryption standard is very weak and there are easily accessible tools on the Internet for decrypting passwords encrypted with this standard. Type 5 is more secure but must be invoked manually for each password configured.
This is what confuses me. It says that you can manually invoke Type 5 security (which is MD5 hashing, also used with enable secret) for each password configured. But by default, it uses Type 7 encryption which is a basic and weak encryption method usually used to guard against over the shoulder snooping at running-configs etc.
I've done some looking around and I can't find any commands that would allow a user to use the enable password command yet encrypt it using Type 5 instead of Type 7. Furthermore, when I looked at Cisco reference pages on the Internet seen here it says the following:
enable password [level level] {password | [encryption-type] encrypted-password} Encryption-Type: (Optional) Cisco-proprietary algorithm used to encrypt the password. Currently, the only encryption type available is 5. If you specify encryption-type, the next argument you supply must be an encrypted password (a password already encrypted by a Cisco router).
This is for the enable password command and it says default encryption type is 5 using IOS version 12.2. But when I use service password-encryption
on a switch that has 12.2 IOS the running-config shows: enable password 7 121AOC041104
the 7 meaning Type 7.
So, as you can see. I'm confused. There are contradictions concerning the default Type of encryption used with enable password. Although the netacademy resources are a few years old, actual testing with switches and using the service password-encryption
command support the netacademy materials. Whereas the Cisco site quotes type 5 being the default using one of the latest IOS versions.
Basically, my question is, despite all of these confusions, is it possible to use enable password to get a Type 5 encryption (and this would be evident in the running-config) or do I have to stick with enable secret to get my Type 5 encryption?