Disabling Cisco Router Password Recovery Service

Most Cisco engineers are aware of the classic Password-Recovery service Cisco equipment have. If the device's credentials are lost, then performing the Password-Recovery procedure will effectively provide full access to the device's configuration.

By disabling the Password-Recovery service you prevent anyone with physical access to the device (e.g console port) from performing the Password-Recovery process and obtaining access to its configuration.

Disabling the Password-Recovery service requires extreme attention because should you loose your password, there is no turning back. It is highly advisable to always keep a backup of your configurations in a secure area - just in case.

You will also notice that the 'no service password-encryption' command will not show up when hitting '?' (for help) as this command is undocumented in the IOS help.

Following are the steps to disable the Password-Recovery service and the message confirmation shown when the device boots up after the Password-Recovery service is disabled:

R1(config)# no service password-recovery

WARNING:
Executing this command will disable password recovery mechanism.Do not execute this command without another plan forpassword recovery.
Are you sure you want to continue? [yes/no]: yes

R1(config)# exit
R1# reload
Proceed with reload? [confirm]

After the reload command is confirmed, the router will proceed with the reload process, which is basically a reboot. As the reload process is performed, the router will verify with a message that the password recovery functionality is disabled:

System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)
TAC Support: http://www.cisco.com/tac
Copyright (c) 1986-2009 by Cisco Systems, Inc.
c2811 processor with 240640 Kbytes of main memory

Main memory is configured to 64 bit mode with parity disabled

Readonly ROMMON initialized

PASSWORD RECOVERY FUNCTIONALITY IS DISABLED

Article Summary

This article explains the password-recovery service and how to disable it on a Cisco device.

If you have found the article useful, we would really appreciate you sharing it with others by using the provided services on the top left corner of this article. Sharing our articles takes only a minute of your time and helps Firewall.cx reach more people through such services.