Password Policies

15 min In Progress

Learning Objectives

Know why enable secret beats enable password
Configure a minimum length + lockout policy
Build a password policy validator

Secret vs Password

enable secret hashes the password (much stronger); the old enable password is reversible -- never use it. Add a minimum length and a lockout rule so brute-forcing becomes impractical.

Real Cisco IOS syntax -- reference only.

service password-encryption
enable secret MyStrongPass!2026

security passwords min-length 10
login block-for 120 attempts 3 within 60

Practice — Policy Validator

Checking a password against length + complexity rules in Python.

def meets_policy(password, min_length=10):
    has_upper = any(c.isupper() for c in password)
    has_digit = any(c.isdigit() for c in password)
    return len(password) >= min_length and has_upper and has_digit

print(meets_policy("shortpw"))
print(meets_policy("MyStrongPass2026"))

📝 Exercise: Build a Full Policy Checker

Extend meets_policy into check_password(password) that returns a list of every rule it FAILS (empty list = pass). Rules: at least 10 characters, at least one uppercase letter, at least one digit, at least one symbol from '!@#$%^&*', and must not be in a small COMMON_PASSWORDS set.

code.py

COMMON_PASSWORDS = {"password123", "admin123", "changeme"}
candidates = ["shortpw", "password123", "MyStrongPass!2026", "alllowercase1!"]

def check_password(password):
    failures = []
    if len(password) < 10:
        failures.append("too short (need 10+ characters)")
    if not any(c.isupper() for c in password):
        failures.append("missing an uppercase letter")
    if not any(c.isdigit() for c in password):
        failures.append("missing a digit")
    if not any(c in "!@#$%^&*" for c in password):
        failures.append("missing a symbol")
    if password.lower() in COMMON_PASSWORDS:
        failures.append("is a known common password")
    return failures

for pw in candidates:
    result = check_password(pw)
    print(pw, "->", result if result else "PASS")

Output

← Back to Chapter