By default, admins can use hashed passwords. When hashed, passwords are not validated using standard user validation policies. You can disable the use of hashed passwords, ensuring that the passwords must conform to standard user validation policies.
This procedure shows how you can prevent administrators from using the username <userName> password 7 <hashValue> command to set passwords as hashed values. Passwords in plain text are subject to the other password validation rules described in Password validation policies.
Important
The output of the show configuration command contains commands to restore system user accounts. These commands include hashed passwords, which are needed because plain-text passwords are unavailable. If you prohibit hashed passwords, this restoration cannot be done, and those commands will be commented out in the output.
Admin access
Go to CLI configuration mode:
hostname > enable hostname # configure terminal
If you want to prohibit hashed passwords:
hostname (config) # no aaa authentication password local change allow-encryptedIf you want to stop prohibiting hashed passwords:
hostname (config) # aaa authentication password local change allow-encryptedVerify your change:
hostname (config) # show aaa authentication passwordSave your changes:
hostname (config) # write memory