4 ms·
fun fact: Juniper, Cisco and Arista passwords are "encrypted" like this when you list them in `show run`. it's designed to make shoulder surfing slightly harder
by sterlind 4y ago
fun fact: Juniper, Cisco and Arista passwords are "encrypted" like this when you list them in `show run`. it's designed to make shoulder surfing slightly harder, I guess? but like, you can also enter passwords in their encrypted form, so it really doesn't guard anything. and it causes operational screwups, since ops assumes it's actually encrypted and safe to share, when it's literally on par with Barbie typewriters.
- EvanAnderson 4y agoI can't speak to Juniper and Arista, but Cisco passwords are "encrypted" with various algorithms depending on the "type" entered (and capabilities of the device). Not all of the algorithms are terrible, though it's still a good idea to redact passwords when sharing configurations anyway. There's a good rundown here: https://media.defense.gov/2022/Feb/17/2002940795/-1/-1/1/CSI_CISCO_PASSWORD_TYPES_BEST_PRACTICES_20220217.PDF https://media.defense.gov/2022/Feb/17/2002940795/-1/-1/1/CSI...
- tgv 4y agoI'm not sure I quite understand. Why would the password (or something derived from it) be shown at all? Wouldn't a sequence of asterisks or a random string serve the same purpose?
- bombcar 4y agoBecause “show run” can basically be used to copy configs around iirc