How to create strong passwords in Linux?

Question

I wonder how I can create strong passwords on Linux (for both normal and admin users) and if there are specific programs to do that.

Answer 1

pwgen is one of many programs for generating passwords

Answer 2

I wrote this little script a few years ago and have been using it ever since. If anything, it's an interesting abuse of printf and uses a lovely feature of BASH that I unfortunately rarely see in scripts: typeset.

#!/usr/bin/env bash
# Released into public domain
# Aaron Bockover, 2005
# http://abock.org

typeset -i length; length=$1
typeset -i rounds; rounds=$2
[ $rounds -lt 1 ] && rounds=1
[ $length -lt 1 ] && {
    echo "Usage: $0 <length> [<rounds>]" 2>/dev/null; exit 1;
}
for ((i=0; i < $rounds; i++)); do
    for ((j=0; j < $length; j++)); do
        set=$(($RANDOM % 20))
        if   [ $set -le 6 ];  then o=65; l=26; # 35% uppercase
        elif [ $set -le 13 ]; then o=97; l=26; # 35% lowercase
        elif [ $set -le 17 ]; then o=48; l=10; # 20% numeric
        elif [ $set -le 18 ]; then o=58; l=7;  # 10% symbolic
        elif [ $set -le 19 ]; then o=33; l=15; fi
        ord=$(($o + $RANDOM % $l))
        printf \\$(($ord / 64 * 100 + $ord % 64 / 8 * 10 + $ord % 8))
    done
    echo
done

Answer 3

Personally I prefer not to use password generator as password generated are very hard to remember :-). But one portable solution could be to use /dev/random

Creating random passwords which contains no special characters, is 10 characters long

cat /dev/urandom| tr -dc 'a-zA-Z0-9' | fold -w 10| head -n 1

    dyxJRKldvp

Creating random passwords which contains special characters, is 10 characters long

cat /dev/urandom| tr -dc 'a-zA-Z0-9-_!@#$%^&*()_+{}|:<>?='|fold -w 10 | head -n 1| grep -i '[!@#$%^&*()_+{}|:<>?=]'

    MSF4wj@vP0

you can increase length by changing number after -w switch in fold command.
I hope this will help.

Answer 4

I'd also add KeePassX which gives you the option of using system entropy to generate strong passwords with a few nice features - all using GUI. It also gives you the option of managing your passwords, and saving them to an encrypted file.

This is how KPX password generator interface looks like:

Answer 5

I use a non random, but is varied enough for all attack purposes... master password, and last pass to generate other passwords. Here's how I generate the master password.

echo -n "some seed" |  openssl dgst -binary -sha1 | base64 | sed -e 's/.\{4\}/& /g'

and the output

H1sI Wpbj JE2P CdVJ A1qb 9B/e u7M= 

now just pick a few of the sections and make a password, rearrange them, leave some out, add a character or 2 to make it as good as random. As long as you can remember your seed you can regenerate this, and recover your password (so long as you don't make too many modifications)

Answer 6

apg is not a bad choice if you want password that can be easily remembered.

$ apg

Please enter some random data (only first 16 are significant)
(eg. your old password):>
Biecdyphlaj7 (Biec-dy-phlaj-SEVEN)
UcJekIp1 (Uc-Jek-Ip-ONE)
shokDocVed5 (shok-Doc-Ved-FIVE)
at0ocAwch (at-ZERO-oc-Awch)
Oc8ofyink (Oc-EIGHT-of-yink)
yacbidIlt8 (yac-bid-Ilt-EIGHT)

Answer 7

pwgen is a wonderful little cli tool that let's you specify a number of parameters to set complexity, character classes number of passwords to generate, length, etc.

Answer 8

If you are a GNOME user and you also need to store passwords for your various accounts you can try the Revelation password manager. It has a basic password generator feature, in that you only set the password length and choose if to include punctuation characters besides letters and digits.

Answer 9

Just follow the advice here (Yes, a webcomic of all things. Go figure.).

Answer 10

Correct me if I'm wrong, but: As far as I understood it, there is no way a computer can come up with a completely random string. So I came up with the following idea [and hope it isn't completely stupid]:

If one throws a 26-sided dice, the chance to throw, say 26 is 1:26. In other words: The chance to throw 26 is about 0.04%. Further, a dice has no memory and no bugs. I came up with the following idea:

• get a 26 sided dice, where each side matches a letter of the alphabet
• get a ten sided dice where each side matches a number between 0 and 9
• flip a coin
• head means: throw letter dice
• tails means: throw number dice

Paper Models to print out:

• 10 sided dice: http://www.korthalsaltes.com/model.php?name_en=decahedron
• 26 sided dice: http://www.korthalsaltes.com/model.php?name_en=rhombicuboctahedron

Note: I'm not a Math Pro and I came up with this idea after reading an article in 2600 magazine which described this. I just added some of my own ideas on the basic concept.

Also: I wonder if this isn't just a perfect example for 'write your first brute force password cracker'. But your question gave me a perfect reason to bring forth this idea for being discussed.