rds. Basic (Non-AAA) Authentication Since my examples were from a lab where the long arm of the PCI auditors could not reach, I opted for simple passwords. Do you want to enforce secure password standard (yes/no) [y]: no Enter the password for "admin": Feeling rebellious, I typed in admin as a password and went on with my work. Doing SO results in the following command being added to the config: username admin password 5 $1$uioc3i3ii$b071x923gsU09Ebu3/ role vdc-admin User roles are an important feature in NX-OS. In this case, the admin user was added within a VDC. See Chapter 18 for more information on VDCs. The vdc-admin role means that this user has complete administrative rights, but only within this VDC. By default, there are four roles in a Nexus 7000: network-admin Complete read and write access to the entire NX-OS device (only available in the default VDC). network-operator Complete read access to the entire NX-OS device (only available in the default VDC). vdc-admin Read and write access limited to a VDC. vdc-operator Read access limited to a VDC. You can create other roles to limit or add access as you see fit. See the Cisco documen- tation for more detail. PPP Authentication Authenticating a PPP connection is possible through one of two methods: Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP). PAP is the easier of the two to implement and understand, but it is of limited value because it transmits passwords in clear text. CHAP uses a more secure algorithm that does not include sending passwords. Both methods are outlined in RFC 1334. The RFC includes this warning about PAP: PAP is not a strong authentication method. Passwords are sent over the circuit "in the clear", and there is no protection from playback or repeated trial and error attacks. The peer is in control of the frequency and timing of the attempts. Any implementations which include a stronger authentication method (such as CHAP, described below) MUST offer to negotiate that method prior to PAP. I