Creating User Passwords Within An Organization - Red Hat ENTERPRISE LINUX 4 - SECURITY GUIDE Manual

Chapter 4. Workstation Security
• Mix Letters and Numbers — Adding numbers to passwords, especially when added to the
middle (not just at the beginning or the end), can enhance password strength.
• Include Non-Alphanumeric Characters — Special characters such as &, $, and > can greatly
improve the strength of a password (this is not possible if using DES passwords).
• Pick a Password You Can Remember — The best password in the world does little good if you
cannot remember it; use acronyms or other mnemonic devices to aid in memorizing passwords.
With all these rules, it may seem difficult to create a password meeting all of the criteria for good
passwords while avoiding the traits of a bad one. Fortunately, there are some steps one can take to
generate a memorable, secure password.
4.3.1.1. Secure Password Creation Methodology
There are many methods people use to create secure passwords. One of the more popular methods
involves acronyms. For example:
• Think of a memorable phrase, such as:
"over the river and through the woods, to grandmother's house we go."
• Next, turn it into an acronym (including the punctuation).
otrattw,tghwg.
• Add complexity by substituting numbers and symbols for letters in the acronym. For example,
substitute 7 for t and the at symbol (@) for a:
o7r@77w,7ghwg.
• Add more complexity by capitalizing at least one letter, such as H.
o7r@77w,7gHwg.
• Finally, do not use the example password above for any systems, ever.
While creating secure passwords is imperative, managing them properly is also important, especially
for system administrators within larger organizations. The following section details good practices for
creating and managing user passwords within an organization.

4.3.2. Creating User Passwords Within an Organization

If there are a significant number of users within an organization, the system administrators have two
basic options available to force the use of good passwords. They can create passwords for the user,
or they can let users create their own passwords, while verifying the passwords are of acceptable
quality.
Creating the passwords for the users ensures that the passwords are good, but it becomes a daunting
task as the organization grows. It also increases the risk of users writing their passwords down.
For these reasons, most system administrators prefer to have the users create their own passwords,
but actively verify that the passwords are good and, in some cases, force users to change their
passwords periodically through password aging.
26