The enable secret command sets the password required to enter privileged EXEC mode, where users can run show commands and change the device configuration. Configure it in global configuration mode because privileged EXEC access must be protected from unauthorized users. section 5.4 section 5.4.2
Configure and verify an enable secret
R1(config)# enable secret cisco R1(config)# do show running-config | include enable enable secret 9 $9$emuJQV5sVZCY8v$INbrp9XrtfWHieMubzYt7N640m4KXDIqKg/a6SHY9lU The password is stored as a hash rather than cleartext or reversible ciphertext. The leading 9 identifies type 9, commonly associated with scrypt on the demonstrated platform. section 5.4.2
Keep these operational and exam points in mind:
- Prefer enable secret over the legacy enable password. If both are configured, only the enable secret authenticates privileged EXEC access. section 5.4.2 section 5.5
- Hashing is one-way, while service password-encryption applies weak, reversible type 7 encryption to passwords. section 5.4.1 section 5.4.2
- Available hashing algorithms depend on IOS version; type 9 scrypt is more secure than type 5 MD5 when supported. section 5.4.2 section 5.5
