I was wondering if it's possible at all to configure a password policy which enforces password complexity for locally defined accounts. I know it's possible for TACACS+ and RADIUS, but I need to know if it's possible to enforce such policy for locally defined accounts.

The devices I have in scope are running IOS and NX-OS

1 Answer 1


Regarding password complexity for local accounts, you have these options...

  • Cisco NX-OS: I'm not sure you can configure a local password policy in NX-OS; however, NX-OS rejects weak passwords by default. To disable this feature, use no password strength-checking in the global configuration.
  • Cisco IOS:
    • Password length: security password min-length. Admittedly, length is a fairly weak check itself, but IOS at least can detect / deny brute force attacks (see below).

There are a few things to remember...

  • Many older versions of Cisco IOS use a weak "Type 7" hash to protect passwords from shoulder-surfing; there are a billion tools like this on the internet to reverse those hashes. Type 7 hashes should not be considered secure and thus, archive configs in a directory with good permissions enforcement (i.e. your linux tftp directory probably isn't a good location, since most people change tftp file permissions to 777).

    • Ironically the weak "Type 7" algorithm looks secure to the uninitiated, and is enabled with a command called service password-encryption.
    • One should always use the secret keyword when possible in usernames: i.e. username joe secret 5 $1$pJz5$28CTViXggZmhjikYdDyls0. This is at least a decent md5 hash of the plaintext password. Newer IOS versions attempt to use a stronger algorithm, but failed before getting it right.
    • It's not a bad idea to audit local accounts to see whether you can upgrade them to use the secret keyword. In linux, it's as simple as grep ^username /path/to/your/configs/* | grep -v secret (making a note to myself to do this today at my $dayjob)
  • Newer versions of IOS have a feature to trap brute-force attacks against the router; an ACL is applied to the vty.
    • This command would automatically apply an acl to block the offending source IP address for 60 seconds if it had failed password checks 3 times in five minutes: login block-for 60 attempts 3 within 300
    • You can customize the access-list which is applied using login quiet-mode access-class [acl-name]; by default IOS applies an acl called sl_def_acl

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.