Red Hat ENTERPRISE LINUX 3 - INTRODUCTION TO SYSTEM ADMINISTRATION Administration Manual page 129

Chapter 6. Managing User Accounts and Resource Access
6.1.2.1. Weak Passwords
As stated earlier, a weak password fails one of these three tests:
It is secret
•
It is resistant to being guessed
•
It is resistant to a brute-force attack
•
The following sections show how passwords can be weak.
6.1.2.1.1. Short Passwords
A password that is short is weak because it much more susceptible to a brute-force attack. To illustrate
this, consider the following table, where the number of potential passwords that would have to be
tested in a brute-force attack is shown. (The passwords are assumed to consist only of lower-case
letters.)
Password Length
Table 6-1. Password Length Versus the Number of Potential Passwords
As you can see, the number of possible passwords increases dramatically as the length increases.
Note
Even though this table ends at six characters, this should not be construed as recommending that
six-character passwords are sufficiently long for good security. In general, the longer the password,
the better.
6.1.2.1.2. Limited Character Set
The number of different characters that can comprise a password has a large impact on the ability of
an attacker to conduct a brute-force attack. For example, instead of the 26 different characters that can
be used in a lower-case-only password, what if we also used digits? That would mean each character
in a password could be one of 36 characters instead of just one of 26. In the case of a six-character
password, this increases the number of possible passwords from 308,915,776 to 2,176,782,336.
There is still more that can be done. If we also include mixed-case alphanumeric passwords (for
those operating systems that support it), the number of possible six-character passwords increases to
56,800,235,584. Adding other characters (such as punctuation marks) further increases the number of
possible passwords, making a brute-force attack that much more difficult.
However, one point to keep in mind is that not every attack against a password is a brute-force attack.
The following sections describe other attributes that can make a weak password.
1
2
3
4
5
6
Potential Passwords
26
676
17,576
456,976
11,881,376
308,915,776
117