Decrypt passwords in JunOS show configuration

Question

I am trying to backup my configuration on a Juniper m120 OS version 10.1R1.8. I would prefer not to use the archival server configuration because a custom application will kick off backup and not the router itself.

My user's login class is "super-user" and therefore should have all permission bits set including "secret" unless I have misunderstood something. https://www.juniper.net/techpubs/software/junos-es/junos-es93/junos-es-admin-guide/login-classes.html

I have tried:

>show configuration

and

>edit
#save my-config

In either case, the root and user account passwords are encrypted in the output. What should I do? I appreciate your help!

Answer 1

The string shown in the password field of user and root accounts in the Junos configuration is not the password encrypted, but a salted MD5 hash of the password.

A hash by nature is a one-way function - in other words, there is no functional way to take a hash and convert it back to the original password.

When you log into the box, the password you enter is run through the same hashing algorithm (with the salt for that user account applied) and the results are compared - if they match, then Junos knows that the password you entered must be the same as the one that generated the hash that is stored in the configuration.

Regarding the secret permission bit in Junos: this allows you to view sections of the configuration that contain these hashes - if you do not have the secret permission bit set, you will not see any of them - it does not show the original passwords.

I'm not sure why you need to see the password in plaintext format even if you are backing up configuration?

If you restore a backed up configuration to the box, the hash will remain the same and your password will continue to work.