ct to any of a number of devices, such as at an ISP. The user configura- tions would have to be maintained across all devices, and the ISP might have tens of thousands of users. With each user needing a line of configuration in the router, the configuration for the router would be hundreds of pages long. Normal authentication is good for small-scale authentication needs, or as a backup to AAA. Line Passwords Lines are logical or physical interfaces on a router that are used for management of the router. The console and aux port on a router are lines, as are the logical VTY interfaces used for telnet and SSH. Configuring a password on a line is a simple mat- ter of adding it with the password command: R1 (config-line)# password Secret Passwords are case-sensitive, and may include spaces. If a password is not set on the VTY lines, you will get an error when telneting to the device: Password required, but none set Passwords entered in clear text are shown in the configuration in clear text by default. To have IOS encrypt all passwords in the configuration, you need to enable the password-encryption service with the service password-encryption command. Here's an example of passwords in the running configuration displayed in clear text: R1# sho run I include password password Secret1 Here's how to configure the password-encryption service to encrypt all the passwords: R1# conf t Enter configuration commands, one per line. End with CNTL/Z. R1 (config)# service password-encryption R1(config)# exit And here's what the passwords look like in the configuration with the password- encryption service running: R1# sho run I include password password 7 073C244F5C0C0D54 Do not rely on encrypted passwords within IOS being totally secure. They can easily be cracked with tools freely available on the Internet. If you would like to be able to telnet to your device without needing a password, you can disable the requirement with the no login command: (config-line)# no login This, of course, is a bad idea, and should only be done in a