| Previous | Table of Contents | Next |
The first line of defense against unauthorized access to a system is password protection. This is also often the weakest link in the chain. This section describes some steps you can take to keep passwords secure.
The reality is that users want simple, easy-to-remember passwords. They don’t want to change their passwords. They like to write them down so that they can reference them. Unfortunately for you, the systems administrator, these are all bad approaches from a computer security standpoint. Password security requires almost constant attention.
The root password is special. Anyone who knows it can access anything on your system and perhaps other systems that your computer is connected to through a network. Change the root password often, choose it wisely, and keep it secure. It’s best committed to memory. In most organizations, it’s a good idea for two people to know it—but no more than that!
Passwords should be at least six characters long; however, only the first eight characters in any password are recognized. This means that your password is truncated to eight characters if you enter one that’s longer than eight characters.
It’s not too difficult to write a program that can attempt to guess a password. If the password-guessing program is trying to guess a random password, it will take longer to be successful if the password itself is longer.
Computers are very good at doing the same thing over and over, such as encrypting every word in a dictionary and comparing it to your password to try to break into your system. You should never choose a password that’s a dictionary word. Also, try not to choose a password that’s easily associated with you. Your name, address, spouse’s name, child’s name, pet names, phone number, driver’s license number, and so on are all obvious targets for a cracker.
So how do you pick a good password if all the easy ones are also easy to guess? One technique is to pick two random short words and connect them with a punctuation character. This makes an almost random sequence of characters as far as a password guesser is concerned, but is fairly easy for a user to remember. The following are a few examples of passwords that use this technique:
Another method for picking passwords is to take a phrase that you’ll remember and use the first letter from each word for the password. This results in a random sequence of characters, but one that you can easily recall. For example, the phrase “Ladies and Gentlemen, Elvis has left the building” translates into the password L&GEhltb.
The crucial point is that the password should be remembered. It shouldn’t be written down anywhere. If your users feel they must write down their password at all, give them a tip to disguise it in some type of list or sentence. For instance, if your password is modem!at, a note on a small piece of paper saying “Don’t forget to pick up modem! At computer shop for repairs” looks like an ordinary reminder in case another person sees the paper, but the password is well disguised.
Each account on your Linux system is a door into your computer. All someone needs is the right key—the password. If you’ve instituted good password-management practices, you already have a head start toward developing a more secure system. One aspect of computer security that goes hand in hand with password security is login or account security.
Login or account security involves looking for accounts on your system that may be potential security problems and dealing with them. Login security can pose several different kinds of problems.
Many computer crackers succeed in breaking into a computer by simply finding an account that doesn’t have a password. You should check your password file regularly for such accounts and disable them. The password is stored in the second field of the password file under Linux. You can check for a blank password field with several tools, such as grep, awk, or perl. You can disable logins to an account by editing the password file and changing the password field to a * character. This prevents anyone from logging in with that login ID.
• See “Setting User Passwords,” p. 221
If a login name won’t be used anymore, you should delete the account so that it can’t be compromised. At the very least, you should edit the password file and set the password to the * character, which will prevent anyone from logging in to the account. If you choose to delete the account, you should use the find command to locate all files owned by the account and then change their ownership or delete them.
• See “Removing a User,” p. 222
NOTE: If you use other configuration files, such as system mail alias lists, you’ll have to remove the account from those files as well.
Linux comes with several standard login IDs that are required for the operating system to work correctly. For example, the root account has no password when Linux is first installed. You should check the password file when you’ve finished your installations to make sure that all your default accounts have good passwords or have been disabled by setting the password field to a * character.
Some software packages automatically create accounts on your system during their installation processes. Remember to disable them or set their passwords accordingly.
| Previous | Table of Contents | Next |