Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I wonder how I can create strong passwords on Linux (for both normal and admin users) and if there are specific programs to do that.

share|improve this question

11 Answers 11

pwgen is one of many programs for generating passwords

share|improve this answer

I wrote this little script a few years ago and have been using it ever since. If anything, it's an interesting abuse of printf and uses a lovely feature of BASH that I unfortunately rarely see in scripts: typeset.

#!/usr/bin/env bash
# Released into public domain
# Aaron Bockover, 2005
# http://abock.org

typeset -i length; length=$1
typeset -i rounds; rounds=$2
[ $rounds -lt 1 ] && rounds=1
[ $length -lt 1 ] && {
    echo "Usage: $0 <length> [<rounds>]" 2>/dev/null; exit 1;
}
for ((i=0; i < $rounds; i++)); do
    for ((j=0; j < $length; j++)); do
        set=$(($RANDOM % 20))
        if   [ $set -le 6 ];  then o=65; l=26; # 35% uppercase
        elif [ $set -le 13 ]; then o=97; l=26; # 35% lowercase
        elif [ $set -le 17 ]; then o=48; l=10; # 20% numeric
        elif [ $set -le 18 ]; then o=58; l=7;  # 10% symbolic
        elif [ $set -le 19 ]; then o=33; l=15; fi
        ord=$(($o + $RANDOM % $l))
        printf \\$(($ord / 64 * 100 + $ord % 64 / 8 * 10 + $ord % 8))
    done
    echo
done
share|improve this answer
    
Thanx for the script Aaron!!! –  Gasuma Aug 20 '10 at 18:17

Personally I prefer not to use password generator as password generated are very hard to remember :-). But one portable solution could be to use /dev/random

Creating random passwords which contains no special characters, is 10 characters long

cat /dev/urandom| tr -dc 'a-zA-Z0-9' | fold -w 10| head -n 1

    dyxJRKldvp

Creating random passwords which contains special characters, is 10 characters long

cat /dev/urandom| tr -dc 'a-zA-Z0-9-_!@#$%^&*()_+{}|:<>?='|fold -w 10 | head -n 1| grep -i '[!@#$%^&*()_+{}|:<>?=]'

    MSF4wj@vP0

you can increase length by changing number after -w switch in fold command.
I hope this will help.

share|improve this answer
    
You can also use [:print:] for tr (tr -dc '[:print:]'), if you are a bit paranoid. The problem then will be the symbols available on your keyboard... –  lgeorget May 5 '13 at 15:32

I'd also add KeePassX which gives you the option of using system entropy to generate strong passwords with a few nice features - all using GUI. It also gives you the option of managing your passwords, and saving them to an encrypted file.

This is how KPX password generator interface looks like:

enter image description here

share|improve this answer

I use a non random, but is varied enough for all attack purposes... master password, and last pass to generate other passwords. Here's how I generate the master password.

echo -n "some seed" |  openssl dgst -binary -sha1 | base64 | sed -e 's/.\{4\}/& /g'

and the output

H1sI Wpbj JE2P CdVJ A1qb 9B/e u7M= 

now just pick a few of the sections and make a password, rearrange them, leave some out, add a character or 2 to make it as good as random. As long as you can remember your seed you can regenerate this, and recover your password (so long as you don't make too many modifications)

share|improve this answer

apg is not a bad choice if you want password that can be easily remembered.

$ apg

Please enter some random data (only first 16 are significant)
(eg. your old password):>
Biecdyphlaj7 (Biec-dy-phlaj-SEVEN)
UcJekIp1 (Uc-Jek-Ip-ONE)
shokDocVed5 (shok-Doc-Ved-FIVE)
at0ocAwch (at-ZERO-oc-Awch)
Oc8ofyink (Oc-EIGHT-of-yink)
yacbidIlt8 (yac-bid-Ilt-EIGHT)
share|improve this answer

pwgen is a wonderful little cli tool that let's you specify a number of parameters to set complexity, character classes number of passwords to generate, length, etc.

share|improve this answer

If you are a GNOME user and you also need to store passwords for your various accounts you can try the Revelation password manager. It has a basic password generator feature, in that you only set the password length and choose if to include punctuation characters besides letters and digits.

share|improve this answer

Just follow the advice here (Yes, a webcomic of all things. Go figure.).

share|improve this answer
    
Note that these words should be randomly selected. Don't choose them yourself; use dice or a computer. Humans are bad at randomness. –  Jander Oct 9 at 20:58

Correct me if I'm wrong, but: As far as I understood it, there is no way a computer can come up with a completely random string. So I came up with the following idea [and hope it isn't completely stupid]:

If one throws a 26-sided dice, the chance to throw, say 26 is 1:26. In other words: The chance to throw 26 is about 0.04%. Further, a dice has no memory and no bugs. I came up with the following idea:

  • get a 26 sided dice, where each side matches a letter of the alphabet
  • get a ten sided dice where each side matches a number between 0 and 9
  • flip a coin
  • head means: throw letter dice
  • tails means: throw number dice

Paper Models to print out:

Note: I'm not a Math Pro and I came up with this idea after reading an article in 2600 magazine which described this. I just added some of my own ideas on the basic concept.

Also: I wonder if this isn't just a perfect example for 'write your first brute force password cracker'. But your question gave me a perfect reason to bring forth this idea for being discussed.

share|improve this answer
1  
There actually are some ways to generate completely random bits. For example using the electromagnetic noise from your HDD or the variation of IO rates... What is hoped with the generators called 'pseudorandom generators' is that the sequence they output can't be distinguished from a true random sequence by any algorithm running in polynomial time. –  lgeorget May 5 '13 at 15:38

Here's a one-off script for generating XKCD-style passphrases. /usr/share/dict/words isn't a great dictionary for this since most of the words are long, but it is easily available. For nicer passphrases you could use a dictionary of short words such as the S/Key One-Time Password word list.

dict="/usr/share/dict/words"
max="`wc -l <"$dict"`" \
    perl -e '$count=4;
        $/=\4; while (<>) {
            print unpack('L') % $ENV{max} + 1, qq(\n); last unless --$count
        }' /dev/urandom | 
    while read n ; do 
        tail -n "+$n" "$dict" | head -1
    done
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.