Tag Info

Hot answers tagged

54

Since cracklib is open source, the answer can be found in the source code. "Too simplistic/systematic" means that there are too many characters that are preceded by one of their alphabetical neighbors. Hence "ab" or "ba" are considered bad, but "ac" or "ca" are OK since the b is omitted. Before this patch from 2010-03-02, it allows at most four characters ...


51

This is a security thing, it's not actually taking long to realize it. 2 vulnerabilities this solves: this throttles login attempts, meaning someone can't pound the system as fast as it can go trying to crack it (1M attempts a sec? idk). If it did it as soon as it verified your credentials were incorrect, you could use the amount of time it took for it to ...


46

Command lines are not just available in history. They are also available, for example, in the output of ps -ocmd or through the /proc filesystem. (/proc/<pid>/cmdline) which is where ps reads them. Also, users' home directories are often world- or group- readable; you can make the history file only user-readable, but that might not survive deletion ...


43

The other two answers have told you—correctly!—that this is a Bad Idea™. But they've also told you its hard to do, requiring changing a bunch of programs. That's not true. It's very easy. You only need to change one or two configuration files. I feel its important to point this out, because you should be aware of it when logging into systems you don't ...


34

passwd -l is what you want. That will lock the user account. But you'll still be able to su - user but you'll have to su - user as root. Alternatively, you can accomplish the same thing by prepending a ! to the user's password in /etc/shadow (this is all passwd -l does behind the scenes). passwd -u will undo it.


33

Oh dear, okay, let's start at the very beginning... We know that users' passwords are saved in /etc/passwd, but in an encrypted way No, they have been stored in /etc/passwd, and that was quite some time ago. Today passwords are stored in a so-called shadow file, most of the time /etc/shadow. but in an encrypted way, so even the root can't see them: ...


31

On Fedora 19 When I run it I get OK. I'm on Fedora 19. $ echo 'M1uG*xgRCthKWwjIjWc*010iSthY9buc' | cracklib-check M1uG*xgRCthKWwjIjWc*010iSthY9buc: OK Here's the version info: $ rpm -qfi /usr/sbin/cracklib-check | grep -E "Version|Release" Version : 2.8.22 Release : 3.fc19 NOTE: I'd try it with single quotes instead of double qutoes too since ...


26

This is intentional, to try and limit brute forcing. You can usually modify it by looking for the FAIL_DELAY configuration entry in /etc/login.defs and changing its value (mine is 3 seconds by default), although the comment in that file makes it sound like PAM will enforce at least a 2 second delay no matter what


24

Idea #1 - Hidden OS As an alternative method you could make use of TrueCrypt's "Hidden Operating System". This allows you to access a fake alternative OS when a certain password is used, rather than the primary OS. excerpt If your system partition or system drive is encrypted using TrueCrypt, you need to enter your pre-boot authentication password in ...


22

TL;DR: No, password are stored as hashes which can (in general) not be recovered. Linux doesn't store plain-text passwords anywhere by default. They are hashed or otherwise encrypted through a variety of algorithms. So, in general, no, this isn't possible with stored data. If you have passwords stored somewhere other than the /etc/passwd database, they ...


22

This is not a limitation on the part of your SSH server, this is a limitation on the part of your server's method to encrypt passwords. When encrypting passwords on Unix, the crypt() function is called. This may use one of many backends, a possibility is using DES, or another limiting algorithm (for this particular case, I will assume your server is using ...


21

If you allow passwordless sudo, anyone who manages to run code on your machine as your user can trivially run code as root. This could be someone who uses your console while you're logged in but not in front of your computer, which you're not worried about (anyway, someone with physical access can do pretty much what they want). This could also be someone ...


20

Passwords on a linux system are not encrypted, they are hashed which is a huge difference. It is not possible to reverse a hash function by definition. For further information see the Hash Wikipedia entry. Which hash function is used, depends on your system configuration. MD5 and blowfish are common examples for used hash functions. So the "real" password ...


20

Ah, use the passwd program as root: sudo passwd root Or, if you’re running as root already (which you shouldn’t be), just: passwd The root argument can be omitted, because when you execute passwd it defaults to the current user (which is root, as only root can change the root password).


18

pwgen is one of many programs for generating passwords


17

The full list is in man 3 crypt (web version): ID | Method ------------------------------------------------- 1 | MD5 2a | Blowfish (on some Linux distributions) 5 | SHA-256 (since glibc 2.7) 6 | SHA-512 (since glibc 2.7) (Blowfish can be either $2$ or $2a$ according to Wikipedia Crypt ...


17

I suspect you're OS is using DES password encryption, which only supports a maximum of 8 characters. http://serverfault.com/questions/361591/ssh-accepts-only-the-half-password From man crypt(3) GNU EXTENSION The glibc2 version of this function has the following additional features. If salt is a character string starting with the ...


16

Use of passwd -d is plain wrong , at least on Fedora, on any linux distro based on shadow-utils. If you remove the password with passwd -d, it means anyone can login to that user (on console or graphical) providing no password. In order to block logins with password authentication, run passwd -l username, which locks the account making it available to the ...


16

man 5 sudoers informs us that there is an option timestamp_timeout: timestamp_timeout Number of minutes that can elapse before sudo will ask for a passwd again. The timeout may include a fractional component if minute granularity is insufficient, for example 2.5. The default is 5. Set this to 0 to always ...


15

You can drop into single mode from Grub. During boot press Esc on the Grub boot screen when it prompts you to. It may just show you Grub with listings of each kernel - if that's the case don't press Esc. From here select the first entry and press e to edit that entry. Page down to the line that starts with kernel and press e again. This will allow you to ...


15

Passwords on the command line are just a bad idea all the way around. In addition to the methods discussed in the other answers: /proc process list (ps) user's history file User commands can show up in these locations as well: audit logs /var/log/* In addition user's commands can also show up when users login between systems, so in general it's a bad ...


14

From help read: -s do not echo input coming from a terminal


14

Yes, you're looking for mkpasswd, which (at least on Debian) is part of the whois package. Don't ask why... anthony@Zia:~$ mkpasswd -m help Available methods: des standard 56 bit DES-based crypt(3) md5 MD5 sha-256 SHA-256 sha-512 SHA-512 Unfortunately, my version at least doesn't do bcrypt. If your C library does, it should (and the manpage gives ...


14

On any of the Red Hat distros such as Fedora, CentOS, or RHEL the command mkpasswd doesn't include the same set of switches as the version typically included with Debian/Ubuntu. NOTE: The command mkpasswd is actually part of the expect package, and should probably be avoided. You can find out what package it belongs to with either of these commands. $ yum ...


13

sudo -k Will kill the timeout timestamp. You can even put the command afterwards, like sudo -k test_my_privileges.sh From man sudo: -K The -K (sure kill) option is like -k except that it removes the user's time stamp entirely and may not be used in conjunction with a command or other option. This option does not require a password. -k When ...


13

You are thinking that the !, * or x has a special meaning here, and are therefore worrying that there might be some distinction among them. The fact is that these characters are chosen simply because they stand out, at least to Western eyes. These characters connote a missing value, or an exception case, or a warning. You could put boogabooga here and have ...


13

It's not a security flaw; you're able to strace the process because it's your process. You can't just attach strace to any running process. For example: $ sudo sleep 30 & [1] 3660 $ strace -p 3660 attach: ptrace(PTRACE_ATTACH, ...): Operation not permitted su is reporting an incorrect password because it doesn't have sufficient permission to read ...


12

Don't do that... you can either give them root's password or you could execute sudo passwd root (this assumes that sudo is set to use the users password or no password, and that passwd is a command that sudo has authorized to be run by that user).


12

You just have to supply the other system's username in the svn command: $ svn co svn+ssh://otheruser@othersystem/path/to/repo To answer your question's title, too: $ ssh otheruser@othersystem This causes sshd on the remote machine to look in ~otheruser/.ssh/authorized_keys for the public key corresponding to the private key on the machine you're typing ...


12

You need to secure several things, as leaving any of these open introduces a door (it's not really a backdoor since it's all well documented) of similar impact. (Exception: if at step 1 you can physically secure the console as well, then you don't need to do anything else.) Physically secure the computer. You must prevent attackers from disconnecting the ...



Only top voted, non community-wiki answers of a minimum length are eligible