Questions regarding password-based authentication and password management

learn more… | top users | synonyms (1)

2
votes
6answers
182 views

What are the Implications of Passwordless SSH

If UNIX users reach servers via SSH, and we only want to allow pubkey logins, are there any other items that need to be added to this list, that I should be concerned with? Allow pubkey login in ...
2
votes
2answers
10k views

How to remove root password on Debian?

I'm running Debian in a virtual machine and for convenience I would like to remove the password on root (since it doesn't really matter what happens to this box). Internet hasn't been too helpful on ...
2
votes
2answers
733 views

How is using a public-key for logging in to SSH any better than using a password?

I'm not asking about password vs key authentication. I've seen a few times (and even Amazons AWS) says that even if SSH has a major vulnerability that key authentication would make such an exploit ...
2
votes
2answers
159 views

Will I be prompted for the sudo password a second time?

This is what I plan to do: #!/bin/bash sudo -i <<'EOF' iptables-save | awk '/^[*]/ { print $1 } /^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; } /COMMIT/ { print $0; ...
2
votes
3answers
37k views

Kali Linux: On install, designated root password cannot login - incorrect password

I found an old laptop lying around and I figured I would install Kali Linux on it to learn more about penetration testing and to try to break into my servers for practice and learning more about ...
2
votes
3answers
861 views

What happens if I delete all user passwords?

I have a Fedora VPS with a root user that has no password. I login with SSH keys. I had another, less privileged account on that server, used for web administration. I've now deleted its password ...
2
votes
1answer
481 views

Setting the root password vs. sudo -i

Should one always set a root password, or is sudo -i acceptable? Two problems is in reading other posts (maybe junk I realize): sudo -i eliminates the need for a password. Isn't that a problem for ...
2
votes
4answers
2k views

Change password in headless mode

I am building a script to fully automate a VPS setup, and I need to change the root password. I would like to avoid typing it as the script is running through SSH. Is there a way to redirect an ...
2
votes
2answers
447 views

Finding root password

I installed a Ubuntu and it only has a user. I can login to the system without login. It doesn't ask me for un/pwd. but when I am in, and I want to run some commands as root (sudo), it ask for ...
2
votes
4answers
719 views

sudo without password - security? [duplicate]

Possible Duplicate: What specific vulnerabilities am I creating by disabling the sudo password? I'm involved yet again in the old argument on whether sudo without password is secure enough ...
2
votes
1answer
487 views

A local, centralized, secure way to store FTP login data, including passwords

I want to be able to store the login details all of my remote FTP accounts in one place, securely. Then I'd like clients like autofs/curlftpfs, Filezilla, etc to use this one store of passwords. I'm ...
2
votes
2answers
63 views

Add a user wthout password but with SSH and public key

I want to add a user to Red Hat Linux that will not use a password for logging in, but instead use a public key for ssh. This would be on the command line.
2
votes
1answer
153 views

upload and dowload the files from server without giving password

I want to download the file from sever by using cron job, so I need to use scp command without giving password by keyword. How do I do so?
2
votes
1answer
205 views

Hash in the shadow file, but no password?

A very strange thing happened: There is a user that has a HASH: [root@notebook /home/username/Desktop/b/a] cat passwd-machine foo:x:2229:3001:,,,System,fooo,-,userid for ...
2
votes
1answer
565 views

su not asking for password

My su does not ask for password. When I run su it simply logs me in to root. I tried su - root then it asks for password. Now, because of this kdesu runs applications with root rights without ...
2
votes
2answers
112 views

change regular user's password with root access

I have Ubuntu installed on a Raspberry pi. I have a normal user pi, but I forgot the password. However, I do have root access. How would I change pi's password using root?
2
votes
2answers
297 views

How does a BIOS password work?

I have created a BIOS password. I use the Dvorak keyboard layout. When I switch my keyboard layout to Qwerty and restart, and then type password in with the different layout, there is no change. ...
2
votes
2answers
1k views

Using for loop to brute-force a password

I just wanted to brute-force my old router but the for-loop was really amateur style. How to write a nice for-loop, if I only know the charaters included? Found already that page but it does not ...
2
votes
1answer
896 views

wpa_supplicant store password as hash (WPA-EAP with phase2=“auth=PAP”)

Is there a way to store my password in /etc/wpa_supplicant/wpa_supplicant.conf as some hash instead of plaintext? By "password" I refer here to the password used for phase2 authentification. I do not ...
2
votes
1answer
2k views

Apache boot without asking for passwd

So I'm maintaining a server which has a verified SSL certificate setup, however there is a password on the private key and so whenever apache is reboot, we get a message asking for the password. This ...
2
votes
1answer
205 views

Where can I find a reference to the format of the comment field (field 5) of the /etc/passwd file?

In the /etc/passwd file on my system, the "comment" field, field 5, is inconsistent in its contents. I thought that I could extract it to get the full name of the user. fullname=`awk -F: '$1 == name ...
2
votes
3answers
4k views

debian not accepting administrative password

I have XFCE Debian on an old PowerPC PowerBook G4. When I go to open Synaptic Package Manager, a window pops up asking for my administrative password. I enter the password I normally use for sudo in ...
2
votes
1answer
44 views

What are the disadvantages of using config file (source) for passwords in bash scripts

I am writing a bash script that needs to authenticate a Linux box with active directory. I would like to make it so no user input is required. The problem is I have to put the password in the script, ...
2
votes
2answers
52 views

How to know when my password will expire? [duplicate]

How can I get to know when my password will expire? I'm running IBM AIX.
2
votes
2answers
177 views

Change Password Programmatically

In the current version of Raspian, I know it is possible to change the password of the current logged in user from the command line like so: sudo passwd which will then prompt the user to enter a ...
2
votes
1answer
391 views

Why 'mkpasswd -m sha-512' produce different result every time it is called?

I am using this function to create a password in the shadow file $ mkpasswd -m sha-512 password $6$o50n4EfNOBzfs$K5l5AcOI5e0I9n2df0LmR11OLSPKSVM6AGBOnWVfDDfMubb46MrAj0zehdLNEoYzD2fj5q4XUdDwexj/dWLHy/ ...
2
votes
1answer
126 views

How to let a daemon prompt for a password (in Xsession, keyloggersafe)?

Exposition: Working inside an XSession. Some (background) deamon needs to prompt me for password input. How can I make the daemon to prompt me for a password using a popup in the Xsession? ...
2
votes
2answers
2k views

Unable to pass the password to su in a script

I am writing a build script. This script has to copy a file in the end. This file will be placed in another users home directory and it is also necessary that the file belongs to this second user. My ...
2
votes
2answers
3k views

How to force change linux password even if similar as previous

I am trying to change my current password in Red Hat Enterprise Linux Server release 5.10 (Tikanga) but it says my new password is too similar. Is there any way to force change ? $ passwd Changing ...
2
votes
1answer
228 views

Root Password Policy and Refresh

Unfortunately the infrastructure I work in has static root passwords that are very rarely refreshed. So people leaving the company will have our root passwords and it can potentially be leaked to ...
2
votes
3answers
828 views

proper configuration of visudo NOPASSWD for bash backup script

The abstract question is: If script x calls program y, do I need a NOPASSWD entry in /etc/sudoers for x, y or both x & y? (And can x then call sudo -v without a password?) Details: I'm trying ...
2
votes
1answer
4k views

Unix last password change date

My understanding is that the last change date(in /etc/shadow) is the number of days since 01/01/1970 that the password was changed, but I'm seeing numbers like 19708 which translate to 17/12/2023 ...
2
votes
2answers
311 views

Equivalent of “passwd -sa” in RHEL?

I feel a little silly having to ask this, but: In Solaris you can issue a passwd -sa command which gives you (more or less) the same output as passwd -S userName does, except it prints out the status ...
2
votes
1answer
3k views

I try to add passwords to the “pass” password manager. But my attempts fail with “no public key” GPG errors. Why?

I am trying to install Pass: the standard Unix password manager, however, when I try to add passwords to the appliation I get these errors gpg: Kelly's Passwords: skipped: No public key gpg: [stdin]: ...
2
votes
1answer
1k views

SCP and/or SSH command with password in line

First, I'm TRYING to use rsa keys because I'm using the script to create RSA keys, but initially I have to connect to the remote machine to pass over the newly generated authentication key. Having ...
2
votes
1answer
79 views

What does **___________ mean in /etc/shadow?

When I look at /etc/shadow I see several entries that look like this: username:**___________::::::: What does the "**___________" mean? That is where I should see the password hash.
2
votes
1answer
88 views

How to safely transmit a password over SSH for a remote command to use

On the local server, I have a program that stores the password in the predefined environment variable (SPECIAL_PASSWORD). On the remote server I have a program that reads and uses a password from a ...
2
votes
1answer
44 views

GNU Screen - any way to remove password when detached?

Protecting a GNU screen session with a password is good security. However, how does one remove the password if you need to share a session with a colleague? I tried the following to clear it and got ...
2
votes
4answers
78 views

can a super user steal passwords from other users with keylogging?

First, before I get answers containing information that I already know, yes, I'm aware that the superuser can reset passwords, and yes, I know that the superuser can log in as other users without ...
2
votes
1answer
98 views

NIS and /etc/passwd

Shadow passwords are to be avoided in a NIS server, as suggested in this guide at paragraph 7.6. So: in a NIS server (a Unix or Unix-like system), should all the users be migrated to /etc/passwd from ...
2
votes
1answer
158 views

What's the correct way to authenticate a user without PAM?

as my related question doesn't seem to get much love, here another one: What's the proper way to authenticate a user via username/password prompt in Linux nowadays? In principle, I suppose I would ...
2
votes
1answer
3k views

Expired password and SSH key based login with UsePAM yes

There is a SLES 11 machine. The users logs in via SSH and pubkey (mixed, some user uses password, some use ssh key) The sshd_config has: UsePAM yes PasswordAuthentication yes PubkeyAuthentication ...
2
votes
2answers
125 views

Making su ask for password multiple times

Is there some way to make su ask for the password again in case of a wrong password (just as sudo does)? Initially I thought of this: while ! su -c foo; do read -n 1 -p "Retry(y/n)?" ch if [[ ...
2
votes
1answer
638 views

How may I distinguish encryption algorithm of htpasswd?

I have an apache web server running on Debian Linux and I secure a certain directory with htaccess. I have no history or knowledge how the .htpasswd file was created. Apache documentations says that ...
2
votes
1answer
269 views

Nemo: Forget encryption password

I have mounted an encrypted disk by selecting it in Nemo (1.1.2), then typing a password. I can unmount the disk using Nemo, but now it can be remounted without requiring the password. Probably ...
2
votes
1answer
781 views

How to password-less log on via ssh alias

Suppose I have access to pc via a server. I can directly log-on to pc by using How do I connect to a pc through another pc using ssh Such that my .ssh/config looks like: Host short Hostname pc User ...
2
votes
1answer
355 views

password problem when feeding a remote file into diff

When I want to compare a local file with a remote file, any of these usually works: $ ssh remote cat file | diff file - $ diff file <(ssh remote cat file) However, sometimes (especially when the ...
2
votes
1answer
4k views

Brute force access to a Firebird database?

Ok, so here's the deal. When migrating a certain product with terrible documentation to another database type, my Firebird database was deleted. I then proceeded to recover it from the filesystem ...
2
votes
1answer
4k views

How to set a new password from bash?

I'm using busybox with a limited passwd (I don't have --stdin option) and without chpasswd and I need to change the password of an user from bash. Here is my best result: echo newpassword > ...
2
votes
1answer
967 views

root password changed automatically

I have my system on dual boot (win7 and RHEL 6). I have 2 user account on RHEL 6. A normal user and a root user. I put passwords of both accounts same. It was working fine from 5 6 days. Yesterday I ...