Creating Strong Passwords - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Chapter 43. Securing Your Network
cracking attacks. If an intruder can gain access to the machine as a regular user, he can copy the /
etc/passwd file to his own machine and run any number of password cracking programs against
it. If there is an insecure password in the file, it is only a matter of time before the password cracker
discovers it.
Shadow passwords eliminate this type of attack by storing the password hashes in the file /etc/
shadow, which is readable only by the root user.
This forces a potential attacker to attempt password cracking remotely by logging into a network
service on the machine, such as SSH or FTP. This sort of brute-force attack is much slower and
leaves an obvious trail as hundreds of failed login attempts are written to system files. Of course, if the
cracker starts an attack in the middle of the night on a system with weak passwords, the cracker may
have gained access before dawn and edited the log files to cover his tracks.
In addition to format and storage considerations is the issue of content. The single most important
thing a user can do to protect his account against a password cracking attack is create a strong
password.

43.1.3.1. Creating Strong Passwords

When creating a secure password, it is a good idea to follow these guidelines:
• Do Not Use Only Words or Numbers — Never use only numbers or words in a password.
Some insecure examples include the following:
• 8675309
• juan
• hackme
• Do Not Use Recognizable Words — Words such as proper names, dictionary words, or even terms
from television shows or novels should be avoided, even if they are bookended with numbers.
Some insecure examples include the following:
• john1
• DS-9
• mentat123
• Do Not Use Words in Foreign Languages — Password cracking programs often check against
word lists that encompass dictionaries of many languages. Relying on foreign languages for secure
passwords is not secure.
Some insecure examples include the following:
• cheguevara
• bienvenido1
• 1dumbKopf
606