Allows or prevents the use of hashed values as passwords.
Password validation rules are not applied to hashed passwords. To prevent admin users from using the username username password 7 hashValue command to set a hashed (already encrypted) value as a user password, use the no aaa authentication password local change allow-encrypted command in configuration mode. Exclude the no parameter to allow admin users to set hashed passwords (the default behavior).
Prohibiting hashed passwords is a way to keep password validation rules from being circumvented. However, the show configuration command output contains commands to restore system user accounts. These commands include hashed passwords, because plain-text passwords are unavailable. If you prohibit hashed passwords, this restoration cannot be done, and those commands will be commented out in the output.
Syntax
[no] aaa authentication password local change allow-encrypt
Syntax
no
Use the no form of this command to prevent the use of hashed values as passwords.
Example
The following example allows admin users to use hashed values as user passwords.
hostname (config) # aaa authentication password local change allow-encrypt
The following example prevents admin users from using hashed values as user passwords.
hostname (config) # no aaa authentication password local change allow-encrypt
User role
Admin
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Central Management System: Release 7.5
Email Security — Server: Release 7.6
Malware Analysis: Release 7.7
File Protect: Release 7.7
:Endpoint Security (HX) Release 2.5
Network Security: Release 7.5
Intelligent Virtual Execution - Server: Release 7.9