Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm automating some interaction with Cisco ASA devices. I need to do the following:

  1. login over ssh
  2. send 'enable', provide enable password
  3. send 'configure terminal'
  4. send some other commands, never going to deeper level of config.
  5. send exit (gets me back to enable mode prompt)
  6. disable (should get me back to the basic prompt)

Then a bit later, another scripted bit tries to send 'enable' again. This time, the device asks for a username and password. Not just the enable password. This happens consistently on some devices I have tried and never on others. I'm guessing it is something to do with 'disable'. I don't have to use that command, I just need to drop from enable mode back to a regular prompt so that future bits can always expect to start from the base '>' prompt.

Apologies in advance if this is too basic of a question. Any ideas?

share|improve this question
Are you scripting with expect? – Danila Ladner Jun 13 '13 at 18:14
Sort of, not really. I know I can write code to handle "Username" then "Password" instead of just "Password", but I would like to avoid yet another special case. What I'm asking is: "is there any way to avoid this code path?" – kbyrd Jun 13 '13 at 18:26
up vote 0 down vote accepted

Ahh, the answer appears to be this configuration setting:

   aaa authentication enable console LOCAL

With that, disable then enable will require a password.

share|improve this answer
As a best practice, you usually want to have aaa authentication enabled. If it's not and you are able to do so, I would update your script to enable it and create the necessary user accounts as part of your script. – Rex Jun 13 '13 at 18:42
I think it's always requires password when you type enable command, not only disable then enable – cuonglm Jun 13 '13 at 18:54
@Gnouc: That's not my experience testing against an ASA this morning, that's why I asked the question. Enable after initial login asks for Password. doing disable (from enable mode) then enable again asks for Username and Password. – kbyrd Jun 13 '13 at 19:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.