| 1 |
-----BEGIN PGP SIGNED MESSAGE----- |
| 2 |
Hash: SHA1 |
| 3 |
|
| 4 |
lo, |
| 5 |
|
| 6 |
On Wednesday 18 January 2006 17:15, Paweł Madej wrote: |
| 7 |
> Jesse, Rich wrote: |
| 8 |
> > 1) 30 day lifetime |
| 9 |
> > 2) Minimum length of 12 (eep!) |
| 10 |
> |
| 11 |
> This two is not a problem on every linux box |
| 12 |
> |
| 13 |
> > 3) No reuse of passwords (keep password history) |
| 14 |
> |
| 15 |
> In this case i got a problem which app could provide such functionality |
| 16 |
|
| 17 |
There is no way of just doing this normal PAM that I am aware of unless |
| 18 |
cracklib has been extended. |
| 19 |
|
| 20 |
> > 4) Check password for dictionary and common variants (e.g. username) |
| 21 |
> |
| 22 |
> Some proxy between passwd and shadow / PAM ? |
| 23 |
|
| 24 |
cracklib does this. |
| 25 |
|
| 26 |
> > 5) Do not use system-generated passwords |
| 27 |
> |
| 28 |
> Do you follow that example with 30 sign password? |
| 29 |
|
| 30 |
?? |
| 31 |
|
| 32 |
> > 6) Teach users to use an algorithm to generate passwords. |
| 33 |
> |
| 34 |
> User training is very important but even if you prepare good training |
| 35 |
> plan not every one would use it. So we have to force them to use our |
| 36 |
> policy with 1-5 points from above. |
| 37 |
|
| 38 |
This is the entire point. Forcing users to have complex passwords is in almost |
| 39 |
all cases, futile as they simply write them down etc. I assume that most |
| 40 |
people know that users are the weakest link and the FIRST thing you do is to |
| 41 |
educate your users, but contrary to what Rich writes, its my experience that |
| 42 |
while using a simple algorithm seems easy and obvious to the readers of this |
| 43 |
list, it is still beyond most end users (not conceptually but in practise). |
| 44 |
|
| 45 |
The point being that if you don't enforce strong passwords users will use weak |
| 46 |
ones. If you do enforce strong passwords users will use weak means around |
| 47 |
them. It's this catch 22 situation that leads to all security administrators |
| 48 |
moving away from passwords, that and the fact that they are susceptible to |
| 49 |
things like replay attacks, man in the middle attacks and so on. |
| 50 |
|
| 51 |
If you have no choice but to rely on passwords then its a question of knowing |
| 52 |
your users and setting the password policy as appropriate to that. In most |
| 53 |
cases you are better off enforcing complex passwords and just not caring if |
| 54 |
the end user writes them down as this is less of a risk then internet based |
| 55 |
attack vectors. |
| 56 |
|
| 57 |
- -- |
| 58 |
Benjamin Smee (strerror) |
| 59 |
crypto/forensics/netmail/netmon |
| 60 |
-----BEGIN PGP SIGNATURE----- |
| 61 |
Version: GnuPG v1.9.20 (GNU/Linux) |
| 62 |
|
| 63 |
iD8DBQFDznrSAEpm7USL54wRAv0SAJ9ZqOaWlDGqogeToW/eIxLbrmI1IwCdFq9E |
| 64 |
gcih10B1GadCubA+RiU8aCQ= |
| 65 |
=Ro+U |
| 66 |
-----END PGP SIGNATURE----- |
| 67 |
-- |
| 68 |
gentoo-server@g.o mailing list |
Archives