You can secure a router or a switch by using passwords to restrict access. Using passwords and assigning privilege levels is a way to provide terminal access control in a network. It is a form of management plane hardening. You can establish passwords on individual lines, such as the console, and to the privileged EXEC mode.
你可以透過密碼限制存取，藉此保護路由器或交換器。使用密碼並指派權限等級，是在網路中提供終端機存取控制的一種方式，也是管理平面強化的一種形式。你可以在個別線路（例如主控台）以及特權執行模式上設定密碼。
Configure the enable secret password and configure the enable password:
設定 enable secret 密碼並設定 enable password：
Switch(config)# enable secret sanfranSwitch(config)# enable password C1sco123Verify the configured passwords:
驗證已設定的密碼：
Switch# show running-config | include enable
enable secret 5 $1$WPHF$uWo4ucV0/vA1/abu6LlWQ1
enable password C1sco123The enable password and enable secretglobal command restrict access to the privileged EXEC mode.
enable password 與 enable secret 全域命令用於限制對特權執行模式的存取。
The enable secret command in older devices uses the Message Digest 5 (MD5) hashing by default. The number 5 in the command in the configuration indicates that a MD5-type hash was used to protect the password.
舊型裝置上的 enable secret 命令預設使用訊息摘要 5（MD5）雜湊。設定中命令內的數字 5 代表使用了 MD5 類型的雜湊來保護密碼。
There are multiple types of crypto algorithms that can be used to encrypt passwords. The following table includes different types of crypto algorithms, with their description and the algorithms that are used. Password types are listed in chronological order based on their development, and National Institute of Standards and Technology (NIST) recommendation.
有多種加密演算法可用來加密密碼。下表列出不同類型的加密演算法，包含其說明與所使用的演算法。密碼類型依其開發時間順序，並參考美國國家標準暨技術研究院（NIST）的建議排列。
Password Type 密碼類型 | Characteristics 特性 | |
Type 4 Type 4 | The original plan of this password type was to use Password-Based Key Derivation Function version 2 (PBKDF2) algorithm.Due to an implementation issue, it ended up being a single iteration of SHA256 without salt. 此密碼類型原本計畫使用以密碼為基礎的金鑰衍生函式第 2 版（PBKDF2）演算法。由於實作問題，最終變成不加鹽的單次 SHA256 迭代。
| Do not use 請勿使用 |
Type 5 Type 5 | A significant improvement over Type 7 password.Uses MD5 hashing algorithm.The passwords are salted which means that extra random information is added so that you cannot use a simple encrypted password lookup table. 相較於 Type 7 密碼有顯著改善。使用 MD5 雜湊演算法。密碼有加鹽，也就是加入額外的隨機資訊，使你無法使用簡單的加密密碼查詢表破解。
| Not NIST approved Use only if HW does not support Types 6,8 or 9 未經 NIST 核准 僅在硬體不支援 Type 6、8 或 9 時使用 |
Type 6 Type 6 | Uses a reversible 128-bit Advanced Encryption Standard (AES) encryption algorithm, meaning that the device can decrypt the protected password into the plaintext password.Is more secure than Type 7 for cases where the device needs the plaintext password, such as for use as virtual private network (VPN) keys. 使用可還原的 128 位元進階加密標準（AES）加密演算法，意味著裝置可以將受保護的密碼解密回明文密碼。在裝置需要明文密碼的情況下（例如作為虛擬私人網路（VPN）金鑰使用），比 Type 7 更安全。
| Use only when reversible encryption is needed, or when Type 8 is not available. 僅在需要可還原加密，或無法使用 Type 8 時使用。 |
Type 7 Type 7 | This password type uses Vigenre cipher which is a simple alphabetical substitution encryption.Intended to provide protection against someone looking over passwords in configuration.It is extremely easy to reveal the original password. 此密碼類型使用維吉尼亞密碼（Vigenre cipher），一種簡單的字母替換加密。目的是防止有人在設定中偷看密碼。原始密碼極易被還原。
| Do not use 請勿使用 |
Type 8 Type 8 | It is a proper implementation of the type 4 password.It uses 20,000 iterations of SHA256 with an 80-bit salt to provide robust security.Recommended by the NSA. 這是 Type 4 密碼的正確實作方式。它使用 20,000 次 SHA256 迭代，並搭配 80 位元的鹽值以提供強固的安全性。經 NSA 建議使用。
| Recommended 建議使用 |
Type 9 Type 9 | It uses a Scrypt hashing algorithm with an 80-bit salt.Scrypt was specifically designed to make cracking very difficult. 使用搭配 80 位元鹽值的 Scrypt 雜湊演算法。Scrypt 是特別為使破解變得非常困難而設計的。
| Recommended 建議使用 |
You can also add a further layer of security to any plaintext passwords in your configuration, which is particularly useful when the configuration is viewed, or when it is stored elsewhere, such as on a TFTP server. To enable encryption when plaintext passwords are viewed, enter the service password-encryption command in the global configuration mode. Passwords that are already configured, or set after you configure the service password-encryption command, will no longer appear in plaintext when you view the configuration. However, note that service password encryption uses type-7 obfuscation, which is not very secure. There are several tools and web pages available that convert a type-7 protected password into a plaintext string.
你也可以為設定中的任何明文密碼加上額外一層安全性，這在檢視設定或設定被儲存在其他位置（例如 TFTP 伺服器）時特別有用。若要在檢視明文密碼時啟用加密，請在全域設定模式中輸入 service password-encryption 命令。已經設定的密碼，或是在你設定 service password-encryption 命令之後設定的密碼，在你檢視設定時將不再以明文顯示。然而請注意，service password encryption 使用的是 Type 7 混淆處理，安全性並不高。有多種工具與網頁可以將受 Type 7 保護的密碼轉換回明文字串。
Password Recovery
密碼復原
enable password command with the service password-encryption command?當搭配使用 enable password 命令與 service password-encryption 命令時，下列何者敘述正確？