Restrict access to Cisco device

If you allow them to look at the full running-config then you are allowing them to look at the passwords, some of which are kept in plaintext and some of which are encoded. The older password encoding is known to be easily invertable (if you find the right program), but the newer password encoding has no publically known decoding algorithm.

For example, if you give them read access to the full configuration then they will be able to see the SNMP write community strings; if you have not locked down SNMP access thoroughly, then they could use SNMP to trigger the tftp in of a new encoded enable password, do whatever they wanted, and set it back before it was missed.

In short, Don't Do That. Either only give them access to portions of the configuration, or else go ahead and give them a write password and appropriate instructions and set whatever monitoring you feel you need.

Thank you for your reply. We don't really care if he can do all that stuff, with hacking the password because we know he don't really know how, he's just learing IOS. We will eventually give him access it's just we don't really want him to accidently kill any of our gear. Is there a command i can use so he can just look at the full running-config?

Thank you.

Walter Robers> >