[c-nsp] Deactive password recovery feature

[Ted Mittelstaedt]

>-----Original Message-----
>From: David Freedman [mailto:david.freedman at uk.clara.net]
>Sent: Tuesday, August 02, 2005 11:23 AM
>To: Ted Mittelstaedt
>Cc: cisco-nsp at puck.nether.net
>Subject: Re: [c-nsp] Deactive password recovery feature
>
>
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Sure, I believe the objective opf the feature  is to protect the
>configuration of the device from your customers prying eyes.
>
>Obviously Cisco wouldn't like to prevent people resetting the NVRAM back
>to factory defaults as if they couldn't, the router becomes a rather
>expensive brick :)
>

When they first came out with that command, the instructions for
defeating it were NOT in the documentation.  And I can't say for
certain but I think the startup-config clearing wasn't in the
rommon either.  I recall though that some hackers stumbled over the
trick to defeating it.

Obviously it's a catch-22 situation, you can't build a router so
that the default is to ignore password resetting, (ie: in the
rommon) yet if you don't do it that way there will always be a
time during the router's boot cycle that the default of not
ignoring the break is in force.

Kind of like the PC motherboards that have password protection in
them - easily defeatable by removing the battery and waiting a week
or so.

I cannot imagine who must have pressed Cisco to put this command
into their IOS, but clearly their paranoia must have been all
encompassing.  Perhaps the local Mafia is using Cisco devices?

>If you are serious about stopping customers getting access to the
>machine then you may as well fill the console and auxilary ports with
>expoxy resin....
>

Or put it in a locked closet?  Or even better yet, if you catch your
non-approved employees breaking into it, firing them?  That to me is
really the only solution that works, it's a pity so many people don't
seem to understand that.

Ted