Allied Telesis AT-9000/28, User Manual

Page: 1093 / 1278

AT-9000 Switch Command Line User’s Guide
Section XI: Management Security 1093
Command Mode
Restriction
Command mode restriction allows you to enhance the security of the
manager accounts by requiring that managers who have the privilege level
15 enter a special password to move from the User Exec mode to the
Privileged Exec mode. Managers who do not know the special password
are restricted to the User Exec mode, just as if their accounts had the
privilege level 1.
When command mode restriction is active on the switch, managers are
prompted for the special password when they enter the ENABLE
command to move from the User Exec mode to the Privilege Exec mode.
The prompt is shown in Figure 175.
Figure 175. Password Prompt for Command Mode Restriction
If the manager enters the correct password, the Privileged Exec mode
prompt is displayed. If the wrong password or no password is entered, the
manager remains in the User Exec mode.
The command for activating command mode restriction and defining the
special password is the ENABLE PASSWORD command, in the Global
Configuration mode. For instructions on how to use the command, refer to
“Activating Command Mode Restriction and Creating the Special
Password” on page 1097.
Command mode restriction does not apply to manager accounts with the
privilege level 1. Manager accounts with that privilege level are always
restricted to the User Exec mode.
Password
Encryption
When you create a new manager account, you have to assign it a
password. You also have to create a new password if you activate
command mode restrictions. The commands for creating manager
accounts and activating command mode restriction give you the choice of
entering new passwords in either plaintext or encrypted form. Password
that are entered in plaintext are stored by the switch in either plaintext or
encrypted form in the running configuration and the active boot
configuration file, depending on the password encryption setting. If
password encryption is enabled, the default setting, plaintext passwords
are stored in encrypted form. If password encryption is disabled, plaintext
passwords are stored in plaintext.
awplus Login: adams
Password: ********
awplus> enable
Password: