username [name] secret [password]
Creates a local user account with an encrypted password (using MD5 hashing) for authentication on Cisco IOS devices, typically used for SSH, console, or AUX access.
Definition: username [name] secret [password] is a Cisco IOS global config command. Creates a local user account with an encrypted password (using MD5 hashing) for authentication on Cisco IOS devices, typically used for SSH, console, or AUX access.
Overview
The `username [name] secret [password]` command is a fundamental security configuration on Cisco IOS devices, used to create local user accounts with encrypted passwords for authentication. This command is critical for controlling access to the device via SSH, console, or AUX lines, especially in environments where centralized authentication (like RADIUS or TACACS+) is not available or as a fallback. The 'secret' keyword triggers MD5 hashing of the password, storing it as a type 5 hash in the running configuration, which is more secure than the older 'password' keyword that stores the password in plaintext (type 0) or weak encryption (type 7).
This command is typically used when configuring local authentication for management access, such as SSH or console login, and is often paired with 'login local' on VTY or console lines. It fits into the broader security workflow by providing a local database of credentials that the device can reference for AAA (Authentication, Authorization, and Accounting) services. Important IOS behaviors include: the password is hashed immediately upon entry and stored in the running configuration; the hash is not reversible, so if the password is lost, the user must be recreated; the command requires global configuration mode (privilege level 15); and the running configuration will show the hashed password, which can be copied to startup config.
The command is available in all IOS versions, but the hash algorithm (MD5) is consistent across versions. Alternatives include using 'username [name] password [password]' (less secure) or integrating with an external AAA server. This command is a cornerstone for device security and is essential for CCNA and CCNP candidates to master.
username [name] secret [password]When to Use This Command
- Configuring local user accounts for SSH remote management access to a router or switch.
- Setting up authentication for the console line to require a username and password.
- Creating multiple user accounts with different privilege levels for network administrators.
- Enabling local authentication as a fallback when a RADIUS/TACACS+ server is unreachable.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| name | WORD (username, e.g., admin, cisco) | Specifies the username for the local user account. The name is case-sensitive and can contain letters, numbers, and hyphens. Common mistakes include using spaces or special characters that are not allowed, or creating duplicate usernames (which will overwrite the existing one). |
| secret | 0 | 5 | 8 | 9 (optional encryption type) or WORD (password) | The 'secret' keyword indicates that the password will be encrypted using MD5 (type 5) by default. Optionally, you can specify an encryption type: 0 for plaintext (not recommended), 5 for MD5 hash, 8 for PBKDF2 (stronger), or 9 for SCRYPT (strongest). If no type is specified, the password is hashed with MD5. The password must be at least 1 character long; common mistakes include using weak passwords or forgetting that the password is case-sensitive. |
Command Examples
Create a user with encrypted secret for SSH access
username admin secret Cisco123No output is displayed upon successful execution. The command creates a user 'admin' with an MD5-hashed secret 'Cisco123'. The secret is stored encrypted in the running configuration.
Verify the user account in running configuration
show running-config | include usernameusername admin secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0
The output shows the username and the encrypted secret (type 5 MD5 hash). The hash is not reversible; only the hash is stored.
Understanding the Output
The 'username [name] secret [password]' command produces no direct output on the CLI. To verify, use 'show running-config | include username' which displays the username and the encrypted secret (type 5 hash). The hash is a one-way MD5 digest, ensuring the plaintext password is not stored.
In a production network, you should see the secret prefixed with '5' indicating MD5 encryption. If you see '7' (type 7 weak encryption) or plaintext, the configuration is insecure. Always use 'secret' instead of 'password' for stronger encryption.
Configuration Scenarios
Configure local user for SSH access on a branch router
A network engineer needs to enable secure remote management on a Cisco router at a branch office. The router does not have access to a central AAA server, so local authentication must be used for SSH access.
Topology
R1(Gi0/0)---192.168.1.0/24---(Gi0/0)Admin-PCSteps
- 1.Step 1: Enter global configuration mode: R1# configure terminal
- 2.Step 2: Create a local user with a strong password: R1(config)# username admin secret Str0ngP@ssw0rd
- 3.Step 3: Enable SSH server: R1(config)# ip domain-name courseiva.com; R1(config)# crypto key generate rsa modulus 2048
- 4.Step 4: Configure VTY lines for SSH and local login: R1(config)# line vty 0 4; R1(config-line)# transport input ssh; R1(config-line)# login local
- 5.Step 5: Verify configuration: R1# show running-config | include username; R1# show ip ssh
! R1# configure terminal R1(config)# username admin secret Str0ngP@ssw0rd R1(config)# ip domain-name courseiva.com R1(config)# crypto key generate rsa modulus 2048 R1(config)# line vty 0 4 R1(config-line)# transport input ssh R1(config-line)# login local R1(config-line)# end R1#
Verify: Use 'show running-config | include username' to see the hashed password (type 5). Use 'show ip ssh' to confirm SSH is enabled. Attempt an SSH connection from Admin-PC: ssh admin@192.168.1.1. Expected: successful login.
Watch out: A common mistake is forgetting to generate RSA keys before enabling SSH; SSH will fail to start. Also, ensure the username and password are correctly typed; the password is case-sensitive.
Configure local user for console access with privilege level
A network administrator wants to restrict console access to a specific user and assign that user privilege level 15 for full access, while keeping the default console login without authentication for emergency access.
Topology
R2(Con0)---Console Cable---Admin-LaptopSteps
- 1.Step 1: Enter global configuration mode: R2# configure terminal
- 2.Step 2: Create a local user with privilege level 15: R2(config)# username netadmin privilege 15 secret C0ns0le!Pass
- 3.Step 3: Configure the console line to use local authentication: R2(config)# line console 0; R2(config-line)# login local
- 4.Step 4: (Optional) Set a timeout to auto-logout: R2(config-line)# exec-timeout 5 0
- 5.Step 5: Verify: R2# show running-config | section line con 0
! R2# configure terminal R2(config)# username netadmin privilege 15 secret C0ns0le!Pass R2(config)# line console 0 R2(config-line)# login local R2(config-line)# exec-timeout 5 0 R2(config-line)# end R2#
Verify: Connect via console and log in with username 'netadmin' and password 'C0ns0le!Pass'. Use 'show privilege' to confirm privilege level 15. Expected: 'Current privilege level is 15'.
Watch out: If you do not specify 'privilege 15', the user defaults to privilege level 1, which severely limits available commands. Also, if you lock yourself out, you may need to perform password recovery via ROMMON.
Troubleshooting with This Command
When troubleshooting authentication issues related to the 'username secret' command, the first step is to verify that the user account exists and the password hash is correct. Use 'show running-config | include username' to confirm the username and the hashed password (type 5). If the password is shown as type 7 (weak encryption) or plaintext, the 'secret' keyword was not used; recreate the user with 'secret'.
Common symptoms include 'Authentication failed' messages during SSH or console login. This often indicates a mismatch between the entered password and the stored hash. Since the hash is one-way, you cannot recover the password; you must delete and recreate the user.
Another symptom is that the user cannot access the device at all; check if the user has the correct privilege level (default is 1) by using 'show running-config | include username' and looking for 'privilege' keyword. If no privilege is set, the user may have limited commands. Also, verify that the line (VTY or console) is configured with 'login local' — use 'show running-config | section line vty' or 'show running-config | section line con 0'.
If 'login local' is missing, the device may use no authentication or fall back to other methods. For SSH issues, ensure that the SSH server is enabled with 'ip ssh' and that RSA keys are generated. Use 'debug ip ssh' or 'debug aaa authentication' to see detailed authentication attempts.
A step-by-step diagnostic flow: 1) Check running config for username and line configuration. 2) Attempt login and observe error messages. 3) If 'Authentication failed', recreate the user with a known password. 4) If 'Password required, but none set', ensure the user has a password. 5) If 'Access denied' due to privilege, set privilege level. Correlate with 'show users' to see active sessions. Also, check if the device has AAA enabled with 'aaa new-model'; if so, local authentication may be overridden by AAA methods.
Use 'show aaa method-list authentication' to see the order. In summary, the 'username secret' command is reliable, but misconfigurations in line settings or AAA can cause authentication failures.
CCNA Exam Tips
CCNA exam expects you to know that 'secret' uses MD5 hashing, while 'password' uses weak type 7 encryption.
Remember that the 'username' command is configured in global config mode, not line mode.
You must also configure 'login local' on the line (e.g., line vty 0 4) to use local authentication.
The 'secret' keyword is preferred over 'password' for security; exam questions often test this distinction.
Common Mistakes
Using 'password' instead of 'secret' — results in weak encryption (type 7) that is easily decrypted.
Forgetting to apply 'login local' on the VTY lines after creating the user account.
Typing the password in plaintext in the running config by using 'username admin password Cisco123' without the 'secret' keyword.
Not using a strong password or reusing default credentials, leading to security vulnerabilities.
username [name] secret [password] vs login local
These two commands are often confused because they work together to enable local authentication: 'username [name] secret [password]' creates the local user database, while 'login local' tells a line to use that database for authentication. Understanding their distinct roles is critical for correctly configuring secure access on Cisco IOS devices.
| Aspect | username [name] secret [password] | login local |
|---|---|---|
| Scope | Global configuration (affects whole device) | Line configuration (affects a specific line like vty, console) |
| Configuration mode | Global configuration mode | Line configuration mode (e.g., line vty 0 4) |
| Persistence | Saved in running-config and startup-config | Saved in running-config and startup-config |
| Precedence | Creates user entries in local database | Specifies authentication method as local (uses username database) |
| Typical use | Defining user credentials for SSH, console, or AUX | Enforcing local authentication on lines for secure access |
Use username [name] secret [password] when you need to create a local user account with an encrypted password for authentication on the device.
Use login local when you need to configure a specific line (e.g., vty, console) to require username/password authentication using the local database.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the 'username secret' command syntax is identical to classic IOS, but the default hash algorithm may be stronger (type 8 or 9) in newer versions (16.x+). You can specify 'algorithm-type md5' to force MD5. In NX-OS (e.g., Nexus switches), the equivalent command is 'username [name] password [password] [role [role-name]]' — note that NX-OS uses 'password' instead of 'secret', and the password is hashed by default (type 5).
To set a role, use 'role network-admin' for full privileges. Example: 'username admin password MyPass123 role network-admin'. In ASA (Adaptive Security Appliance), the command is 'username [name] password [password] privilege [level]' — the password is stored in encrypted form (type 8 by default in newer versions).
Example: 'username admin password Cisco123 privilege 15'. In IOS-XR, the command is 'username [name] secret [password]' similar to IOS, but it uses a different encryption algorithm (type 8 or 9). Also, IOS-XR requires the user to be assigned to a task group for permissions.
For all platforms, be aware that the 'secret' keyword is not available in NX-OS; use 'password' instead. In older IOS versions (12.x), only type 5 (MD5) is supported; type 8 and 9 were introduced in 15.x. Always check the platform documentation for the exact syntax and hash algorithm support.
Related Commands
enable secret [password]
Sets an encrypted password for privileged EXEC access, replacing the less secure 'enable password' command.
login local
Configures the line to require local username/password authentication using the local database, typically applied to console, vty, or aux lines for secure access.
show running-config
Displays the current active configuration in DRAM, showing all non-default settings.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions