- [Instructor] One of the most basic security features
built into Cisco's iOS
are privilege levels.
These levels range
from zero to 15
and by default
the Cisco router has three privileged levels, predefined.
Those are level zero,
level one and level 15.
Level one is also referred to more commonly as user level
and level 15,
you've probably heard called privileged level.
Level zero is simply referred to as
level zero privilege.
The higher the privilege level
that you grant,
the more access
the user will have to the router.
So level 15
or privileged level access
will give you complete control
over the router.
Level one or user level access
would give you the ability to perform
read only commands
that are pretty limited
and the level zero is the most restricted.
That's going to only allow you
to run five commands.
And basically those commands
will either allow you
to log out of the CLI
or to enter a higher privilege level.
Now why would we want different privilege levels?
Well, this goes back to a best practice in security
called least privilege.
We don't want all of our employees
to have complete control
over our devices.
In fact, the principle of least privilege
states that we want to give employees
the minimum amount of access required
to perform their job duties.
So maybe you have a help desk support employee
who's really good at troubleshooting,
but maybe they're not that knowledgeable
from the engineer standpoint.
In that case,
you might want to give them
limited level one access
so they can perform
simple show commands
and maybe pings.
Senior engineers or admins
would require higher levels of access
so that they can make a necessary configuration changes
and to perform more advanced troubleshooting.
So let's connect into a Cisco router
and take a look at this
from a command line standpoint.
Here I'm connected to a Cisco router.
I have not yet configured
any privileged level passwords.
So by default,
there are none in place.
And what we want to look at
in regard to privilege levels
is not only the level of access
that each one of those gives you,
but it's a best practice
to put a password
on those privileged levels
so that users
have to be authorized
before they're allowed to do certain actions.
And so, if we want to see the current privilege level,
I'll hit enter
to get logged into this router.
When we clear,
the command line off just a bit.
And we can very simply see
which privileged level we're currently at,
with the show privileged command.
And if we run that,
you can see that
currently we are at level one,
which is user level privilege.
If we use the enable command,
now you can see that
we go right into privilege level.
We can verify that again
with the show privileged command
and you can see that we are now
at privileged level 15.
So we have complete control
over the router at point.
Now obviously that's not a good idea
to leave this unprotected.
So by default
there is not going to be an enable password in place.
So we want to set
an enable password.
So that we protect our privilege level.
If we used contextual help
by entering a question mark here,
you can see all of the commands
that we have at our disposal.
We have a complete
list of commands that we can do here.
So lots and lots of things that we're able to do.
I'll go ahead and break out of that.
And we want to configure our enable password now.
So we can go under a global configuration mode
with a command config T
and then we can say
enable password and then we can follow that
with our actual password.
In this case,
I'm going to use Cisco
just to keep it simple.
Now obviously you want to use
a much more complex password
in your real world environment.
But just for lab purposes,
I'll just use the simple password.
So this is a very basic way
to create a password
and this is actually
an unencrypted password.
And we can see that in the configuration file.
If we do a show run command,
we'll give that some time to build that.
So in our output now,
you can see that the password
is clearly displayed there.
We have the command enable password, Cisco.
So another best practice
for protecting our privileged levels
is to hide this clear text password
in our configuration file.
And there are a couple of ways
that we can do that.
First, we can use the command
service, password, hyphen, encryption.
When we use that command
for any passwords
in our configuration file
that are stored in plain text,
this command is going to change those
to hashed values instead.
So if we say that
and then I do a show run command
and I'm going to use pipe two,
include, enable and that's going to get us
right to our enable password section
so we don't have to scroll through that.
Now you can see
that our plain text password
is listed as
a type seven password instead.
That's indicated by the number seven
in this output.
So type seven is a Cisco encryption algorithm
that simply hides the password through hashing.
Now the bad news is
this is really, really easily reversed.
In fact, if you do a quick internet search,
there are several websites
that will come up
that will allow you just
to copy and paste
this hashed value that we see on the screen.
You can paste it
in their website
and it will immediately return
the plain text password equivalent.
So it's not super secure.
A better way to do this,
is to use the enable secret command.
So if we say,
enable secret and we use the word
router as our password,
that's actually going to encrypt the password
with md5 encryption.
And by the way,
if we try to use the same password here,
if we try to use the same Cisco password,
we'll actually get an error
stating that we should not create
an enable secret password
that is the same
as the normal enable password
and it's going to prompt us to enter a different password.
And actually let's do that
so you can see that message.
If we try to say enable secret Cisco,
notice it tells us,
"the enable secret that you've chosen
"is the same as your enable password.
"This is not recommended.
"Re-enter the enable secret password."
So it doesn't want us to do that.
So I'm going to go with router here
as the enable secret password.
Then I'm going to hit enter
and if we run that show command again
to jump down to our enable section
where we have in the enable password,
notice our enabled secret password here.
It's showing as type five encryption,
which means that it's using md5 encryption.
You can see the output string
that's given here
is much longer
and therefore it's inherently more secure
because of the larger hash value.
So again, don't use a simple password
such as Cisco or router.
You still want to create strong passwords
even though you have encryption in place.
Because guess what,
these type five passwords
can also be cracked really easily.
Even with the md5 encryption,
if the passwords are simple.
So it takes brute force methods
and again, there are simple websites out there
where we would be able to copy this string value.
We'll be able to pop it in that website
and it would begin brute forcing that password.
So with a simple password
like Cisco or router,
it probably takes five or 10 seconds to
brute force that password.
With longer passwords,
the more complex they are,
you're giving yourself
even more protection.
So again, don't just assume
that because you're using an enabled secret password
that you're being super secure.
You still want to make sure
you have complex passwords in place.
Now if I log out completely
and then I reconnect
by hitting enter,
I'm going to land back at level one,
the user level.
Now if I use the enable command,
notice that I'm prompted for a password
and if I answer that password
that we configured,
the enable secret password,
then I'm granted access
to the higher privilege level.
We can verify that again,
with the show privilege command
and you see that our current privilege level
is set to 15.
Just as we would expect to see.
A couple more commands to point out
is that if you want to move down levels,
you can always go to a lower privilege level
with less access
without being asked for a password.
And you can do that by saying,
disable, followed by
whichever level you want to go to.
So if we say
disable five, notice that we're not prompted
with any message,
but if we again do show privilege,
it says our current privilege level
is at five.
So we can jump backwards with the disabled command.
If we want to go up,
we can say enable.
And if we try to go back to 15 again,
it's going to ask us for that password
because we configured
an enable secret password.
Once we give the password,
then it allows us
to that higher level.
If we say disable, zero,
remember that that is our least privileged level in iOS.
If we say that
and then we use the contextual help,
the question mark command,
notice that we have only five commands available,
so that's very limited
and basically all that we can do here
is either log out from the CLI
or we can attempt
to access higher privilege level.
There isn't really much else
that we can do.
Now in a really large organization,
you might need to create
custom levels with custom commands added.
Let's say, you have a normal user level here
at level zero
and you can see the available commands.
They're very limited,
but let's say that we want to allow users
to also be able to ping for troubleshooting.
Let's say we have some help desk employees
with limited experience,
but we do want to allow them to ping.
We can enter a higher privilege level
with the enable command
and that's going to allow me to configure this.
So I'll get logged in.
Then I'll go under
global configuration mode.
And the command I want to use
is privilege exec level zero.
And that's going to allow us to append
any commands that we want
onto the end.
So in addition to those five commands,
let's say we want to add the ping command,
so we can type ping in there.
If we hit enter,
if we exit,
and if we go back to
our level zero access
and we use our contextual help again.
Now notice, we have the ping command available to us.
So in addition to those five commands,
we've added the ping command.
So that's one way that you can customize
some of the privilege levels
and customize the things
that your users are allowed to do.
Now you can also set up
custom privileged levels
for anything zero through 15.
So you have 16 available levels,
if you need further customization.
So let's have a look at how we can use privilege levels
and privileged level passwords
to protect the configuration,
on our Cisco devices.