Bulk enable password upload tool? 2

[PBrider]

Is there a freeware tool out there that will perform bulk password changes on cisco gear? In compliance with all the SOX standards this is a must, and being able to just push the config change out through one program rather than log into every switch it will save me a ton of time.



Thanks in advance,

Jamie

 

[lerdalt]

If you have SNMP enabled with a read/write string, you could use snmpset from a command line.

 

[brianinms]

On a side note, if you are worried about SOX compliance then why don't you employ Tacacs or radius?

 

[chipk]

Ah, arbitrary SOX standards. How I miss working for a company where every other word out of the mouths of management seemed to involve SOX.

Personally, I use Perl net-telnet-cisco to make mass changes on my systems. Of course, that's pretty unsecure as passwords are transmitted in clear text (so if your network is compromised, so are your Cisco passwords, in theory), so it's somewhat self-defeating if your goal is security and SOX compliance. That could be overcome by using net-ssh, but then you'd need crypto images on all your gear.

SNMP would work, but again, if security is the concern, you'd want to use v3, since it has encryption and authentication.

 

[jneiberger]

I agree with Brian. If you're worried about SOX stuff, you should be using TACACS or RADIUS.

 

[vipergg]

I don't know of too many that are free . On the paid side you have ciscoworks (pricey) , programs from Solarwinds which are more reasonable and also tools from Kiwi also resonable.

 

[burtsbees]

Isn't plshlpme proficient with Perl or UNIX scripting? Someone here once had a few strings that went out and updated the DST on their routers...

Burt

 

[chipk]

That was me with the Perl code. Changing passwords would be something like:

use Getopt::Long;
GetOptions(
     "host=s"     =>     \$host,
     "newpw=s"    =>     \$newpw,
);
  use Net::Telnet::Cisco;
	 $pass='loginpw'; 'current loginpw
	 $enable='enablepw'; 'current enablepw
  my $session = Net::Telnet::Cisco->new(Host => $host);
$session->login('login', $pass); 
$session->enable($enable);
$session->cmd("configure terminal");
$session->cmd("enable secret $newpw");
$session->cmd("end");
$session->cmd("wr mem\n");
exit;

I could build in a conditional test before performing wr mem to make sure the new password took, but the above would work as is, so long as you don't fat-finger something - then you'd be screwed.

 

[burtsbees]

You deserve a star!

Burt

 

[chipk]

Thanks, Burt. Not sure if the original poster will find that useful, but once you get a server or workstation set up with Perl where you can run your scripts from, the possibilities are basically endless. Anything you can do with an expensive package, you can do with Perl. You can even make it look pretty, but I usually just keep it console/text based.

 

[supatech]

Ouch I would be more concerned about the fact your are still using telnet to connect, SSL should be used or you might as well not even have a password. You should really think about using tacacs or radius if you have that many to manage.

CCNA MCSE MCP NET+ A+ Security+

 

[supatech]

http://www.cisco.com/warp/public/707/ssh.shtml

CCNA MCSE MCP NET+ A+ Security+

 

[chipk]

He'd need crypto images, which he likely doesn't have, but I agree.

Just for the record, Perl has a net-ssh package that works essentially the same way as net-telnet-cisco - I've used both.