Red Hat ENTERPRISE LINUX 4 - SECURITY GUIDE Manual

Also see for ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE: Installation guide Installation guide Tuning guide Installation guide Manual

Contents

Chapter 4. Workstation Security24If shadow passwords are deselected during installation, all passwords are stored as a one-way hashin the world-readable /etc/passwd file, which makes the system vulnerable to offline passwordcracking attacks. If an intruder can gain access to the machine as a regular user, he can copy the /etc/passwd file to his own machine and run any number of password cracking programs againstit. If there is an insecure password in the file, it is only a matter of time before the password crackerdiscovers it.Shadow passwords eliminate this type of attack by storing the password hashes in the file /etc/shadow, which is readable only by the root user.This forces a potential attacker to attempt password cracking remotely by logging into a networkservice on the machine, such as SSH or FTP. This sort of brute-force attack is much slower andleaves an obvious trail as hundreds of failed login attempts are written to system files. Of course, if thecracker starts an attack in the middle of the night on a system with weak passwords, the cracker mayhave gained access before dawn and edited the log files to cover his tracks.Beyond matters of format and storage is the issue of content. The single most important thing a usercan do to protect his account against a password cracking attack is create a strong password.4.3.1. Creating Strong PasswordsWhen creating a secure password, it is a good idea to follow these guidelines:Do Not Do the Following:• Do Not Use Only Words or Numbers — Never use only numbers or words in a password.Some insecure examples include the following:• 8675309• juan• hackme• Do Not Use Recognizable Words — Words such as proper names, dictionary words, or eventerms from television shows or novels should be avoided, even if they are bookended withnumbers.Some insecure examples include the following:• john1• DS-9• mentat123• Do Not Use Words in Foreign Languages — Password cracking programs often check againstword lists that encompass dictionaries of many languages. Relying on foreign languages forsecure passwords is not secure.Some insecure examples include the following:• cheguevara• bienvenido1