-
Title
Does TPAM support Cisco IOS 15? What hash types does TPAM support when using the "Cisco Router (SSH)" or "Cisco Router (Tel)" platforms -
Description
Does TPAM support Cisco IOS 15.x?
When using the "Cisco Router (SSH)" or "Cisco Router (Tel)" platforms what password hash types are supported on Cisco IOS? Is the sha245 type 4 hashing supported?
-
Cause
When an account is using a Type 4 hash the following error occurs on a "Password Check"
[DD/MM/YYYY HH:MM:SS] Gathering the check details for managedaccount on CISCODEVICE...[DD/MM/YYYY HH:MM:SS] Retrieving the password hash for managedaccount on CISCODEVICE (((SSH) System) using funcacct ...[DD/MM/YYYY HH:MM:SS] The password for managedaccount in TPAM DOES NOT MATCH the managed system![DD/MM/YYYY HH:MM:SS] Processed the password check for managedaccount on CISCODEVICE in 5.4 seconds
"Test System", "Check Password" on the functional account, and "Reset Password" all work correctly. -
Resolution
TPAM supports type 5 (MD5 encrypted) Cisco hashing. Type 4 (SHA256) is NOT supported by TPAM. TPAM will not support this in a future release as Cisco are deprecating Type 4 support due to it being insecure.
To determine whether your IOS device uses Type 4 refer to the below Cisco Security Response document, the section titled "Determining Whether a Cisco IOS or Cisco IOS XE Release Supports Type 4 Passwords"
http://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-sr-20130318-type4
If support for type 4 hashing is required, or you are using a Cisco IOS version that changes the default secret hash to type 4 it may be possible to add support for this through TPAMs custom platform feature.
-
Change Request
6565