but none set Passwords entered in clear text are shown in the configuration in clear text by default. To have IOS encrypt all passwords in the configuration, you must enable the password- encryption service with the service password-encryption command. Here's an exam- ple of passwords in the running configuration displayed in clear text: R1#sho run I include password password Secret1 Here's how to configure the password-encryption service to encrypt all the passwords: R1#conf t Enter configuration commands, one per line. End with CNTL/Z. R1 (config)# service password-encryption R1(config)# exit And here's what the passwords look like in the configuration with the password- encryption service running: R1#sho run I include password password 7 073C244F5C0C0D54 Do not assume encrypted passwords within IOS are totally secure. They can easily be cracked with tools freely available on the Internet. If you would like to be able to telnet to your device without needing a password, you can disable the requirement with the no login command: R1 (config-line): #no login This, of course, is a bad idea and should only be done in a lab environment. The no login command is available only when aaa new-model is not enabled. Once aaa new-model has been enabled, the login command takes on a different meaning and syntax. This command is discussed in "Enabling AAA" on page 449. Chapter 26: Authentication in Cisco Devices NX-OS switches work a little differently when it comes to authentication. There are no passwords on VTYs the way there are on IOS devices. Instead, authentication is done either through local users or remotely. Configuring Local Users You can create users locally on your networking device. These usernames can then be used for authentication when users log into the device. This is useful when there is a small number of users or when using an external authentication server (discussed in "AAA Authentication" on page 449) is not practical. If you're using AAA authentica- tion, this option is also useful as a backup: you ca