configuring administrator usernames and passwords ·...

Configuring Administrator Usernames andPasswords

• Finding Feature Information, on page 1• Information About Configuring Administrator Usernames and Passwords, on page 1• Configuring Administrator Usernames and Passwords, on page 2• Examples: Administrator Usernames and Passwords Configuration, on page 4• Additional References for Administrator Usernames and Passwords, on page 4• Feature History and Information For Performing Administrator Usernames and Passwords Configuration,on page 5

Finding Feature InformationYour software release may not support all of the features documented in this module. For the latest featureinformation and caveats, see the release notes for your platform and software release.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support.To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is notrequired.

Information About Configuring Administrator Usernames andPasswords

You can configure administrator usernames and passwords to prevent unauthorized users from reconfiguringthe switch and viewing configuration information. This section provides instructions for initial configurationand for password recovery.

You can also set administrator usernames and passwords to manage and configure one or more access pointsthat are associated with the switch.

Strong Passwords

You can set strong administrator passwords such as encrypted passwords with ASCII keys for the administratoruser for managing access points.

Use the following guidelines while creating strong passwords:

Configuring Administrator Usernames and Passwords1

http://www.cisco.com/go/cfn

• There should be at least three of the following categories—lowercase letters, uppercase letters, and digits,and special characters.

Special characters are not supported for username and password for GUI login.Note

• The new password should not be the same as that of the associated username and the username shouldnot be reversed.

• The characters in the password should not be repeated more than three times consecutively.

• The password should not be cisco, ocsic, admin, nimda, or any variant obtained by changing thecapitalization of letters therein, or by substituting "1" "|" or "!" for i, and/or substituting "0" for "o", and/orsubstituting "$" for "s".

• The maximum number of characters accepted for the username and password is 32.

Encrypted Passwords

You can set three types of keys for the password:

• Randomly generated key—This key is generated randomly and it is the most secure option. To exportthe configuration file from one system to another, the key should also be exported.

• Static key—The simplest option is to use a fixed (static) encryption key. By using a fixed key, no keymanagement is required, but if the key is somehow discovered, the data can be decrypted by anyone withthe knowledge of that key. This is not a secure option and it is called obfuscation in the CLI.

• User defined key—You can define the key by yourself. To export the configuration file from one systemto another, both systems should have the same key configured.

Configuring Administrator Usernames and PasswordsProcedure

PurposeCommand or Action

Enters global configuration mode.configure terminal

Example:

Step 1

Switch# configure terminal

Enables strong password policy for theadministrator user.

wireless security strong-password

Example:

Step 2

Switch(config)# wireless securitystrong-password

Specifies a username and password for anadministrator.

username admin-username password {0unencrypted_password | 7 hidden_password |unencrypted_text}

Step 3

The administrator can configure the switch andview the configured information.Example:


Configuring Administrator Usernames and PasswordsConfiguring Administrator Usernames and Passwords

PurposeCommand or ActionSwitch(config)# username adminuser1password 0 QZsek239@

Specifies the secret for the administrator.username admin-username secret {0unencrypted_secret_text | 4 SHA256

Step 4

encrypted_secret_text | 5 MD5encrypted_secret_text | LINE}

Example:Switch(config)# username adminuser1secret 0 QZsek239@

Specifies administrator username and passwordfor managing all of the access points configuredto the switch.

ap mgmtuser username username password{0 unencrypted password | 8 AES encryptedpassword }secret {0 unencrypted password |8 AES encrypted password }

Step 5

You can also include the secret text to performprivileged access point management.Example:

Switch(config)# ap mgmtuser usernamecisco password 0 Qwci12@ secret 0Qwci14@!

If your password is not strongenough to fulfill the strong passwordpolicy, then the password is rejectedwith a valid error message. Forexample, the following password isrejected because it is not a strongpassword.Switch# ap mgmtuser usernamecisco password 0 abcd secret 01234

Note

Specifies the 802.1X username and passwordfor managing all of the access points configuredto the switch.

ap dot1x username username password {0unencrypted password | 8 AES encryptedpassword }

Step 6

Example:Switch(config)# ap dot1x username ciscopassword 0 Qwci12@

Returns to privileged EXEC mode.Alternatively, you can also pressCtrl-Z to exitglobal configuration mode.

end

Example:Switch(config)# end

Step 7

Configures the administrator username,password, and secret text for managing a

ap name apname mgmtuser usernameusernamepassword password secret secret_text

Step 8

specific access point that is configured to theswitch.

Example:Switch# ap name APf0f7.55c7.7b23 mgmtuserusername cisco password Qne35! secretNzep592$

Configures the 802.1X username and passwordfor a specific access point.

ap name apname dot1x-user usernamepassword password

Step 9


Configuring Administrator Usernames and PasswordsConfiguring Administrator Usernames and Passwords

PurposeCommand or Action

Example:Switch# ap name APf0f7.55c7.7b23dot1x-user username cisco password Qne35!

Example

Examples: Administrator Usernames and PasswordsConfiguration

This example shows how to configure administrator usernames and passwords with the strong password policyin configuration mode:

Switch# configure terminalSwitch(config)# wireless security strong-passwordSwitch(config)# username adminuser1 password 0 QZsek239@Switch(config)# ap mgmtuser username cisco password 0 Qwci12@ secret 0 Qwci14@!Switch(config)# ap dot1x username cisco password 0 Qwci12@Switch# end

This example shows how to configure administrator usernames and passwords for an access point in globalEXEC mode:

Switch# wireless security strong-passwordSwitch# ap name APf0f7.55c7.7b23 mgmtuser username cisco password Qwci12@ secret Qwci14@Switch# ap name APf0f7.55c7.7b23 dot1x-user username cisco password Qwci12@Switch# end

Additional References for Administrator Usernames andPasswords

Related Documents

Document TitleRelated Topic

System Management Command Reference Guide (Cisco IOS XE Release3SE (Cisco WLC 5700 Series)

Systemmanagement commands


Configuring Administrator Usernames and PasswordsExamples: Administrator Usernames and Passwords Configuration

Standards and RFCs

TitleStandard/RFC

—None

MIBs

MIBs LinkMIB

To locate and download MIBs for selected platforms, Cisco IOS releases,and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

All supported MIBs for thisrelease.

Technical Assistance

LinkDescription

http://www.cisco.com/supportThe Cisco Support website provides extensive online resources, includingdocumentation and tools for troubleshooting and resolving technical issueswith Cisco products and technologies.

To receive security and technical information about your products, you cansubscribe to various services, such as the Product Alert Tool (accessed fromField Notices), the Cisco Technical Services Newsletter, and Really SimpleSyndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com userID and password.

Feature History and Information For Performing AdministratorUsernames and Passwords Configuration

Feature InformationRelease

This feature was introduced.Cisco IOS XE 3.2SECisco IOS XE 3.3SECisco IOSXE 3.3SE


Configuring Administrator Usernames and PasswordsFeature History and Information For Performing Administrator Usernames and Passwords Configuration

http://www.cisco.com/go/mibs

http://www.cisco.com/support


Configuring Administrator Usernames and PasswordsFeature History and Information For Performing Administrator Usernames and Passwords Configuration