Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #268391 > unrolled thread

Root password strength

Back to article view | Back to linux.debian.user

Contents

  Root password strength Jan Krapivin <daydreamer199005@gmail.com> - 2024-03-19 15:50 +0100
    Re: Root password strength Jan Krapivin <daydreamer199005@gmail.com> - 2024-03-19 16:00 +0100
    Re: Root password strength Dan Ritter <dsr@randomstring.org> - 2024-03-19 16:10 +0100
      Re: Root password strength debian-user@howorth.org.uk - 2024-03-19 16:50 +0100
        Re: Root password strength Greg Wooledge <greg@wooledge.org> - 2024-03-19 21:20 +0100
    Re: Root password strength Greg Wooledge <greg@wooledge.org> - 2024-03-19 16:10 +0100
      Re: Root password strength jeremy ardley <jeremy.ardley@gmail.com> - 2024-03-19 21:30 +0100
        Re: Root password strength <tomas@tuxteam.de> - 2024-03-20 06:40 +0100
          Re: Root password strength Jeffrey Walton <noloader@gmail.com> - 2024-03-20 07:10 +0100
            Re: Root password strength tomas@tuxteam.de - 2024-03-20 08:40 +0100
          Re: Root password strength jeremy ardley <jeremy.ardley@gmail.com> - 2024-03-20 08:50 +0100
            Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-20 12:10 +0100
              Re: Root password strength <tomas@tuxteam.de> - 2024-03-20 12:20 +0100
                Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-20 13:20 +0100
              Re: Root password strength jeremy ardley <jeremy.ardley@gmail.com> - 2024-03-20 12:30 +0100
                Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-20 13:10 +0100
                Re: Root password strength Dan Ritter <dsr@randomstring.org> - 2024-03-20 13:40 +0100
              Re: Root password strength Jeffrey Walton <noloader@gmail.com> - 2024-03-20 14:30 +0100
                Re: Root password strength <tomas@tuxteam.de> - 2024-03-20 14:50 +0100
    Re: Root password strength Marco Moock <mm@dorfdsl.de> - 2024-03-19 16:40 +0100
    Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-19 20:40 +0100
      Re: Root password strength debian-user@howorth.org.uk - 2024-03-19 22:00 +0100
    Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 16:00 +0100
      Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-20 16:20 +0100
        Re: Root password strength Jan Krapivin <daydreamer199005@gmail.com> - 2024-03-20 16:30 +0100
          Re: Root password strength John Hasler <john@sugarbit.com> - 2024-03-20 17:10 +0100
            Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 17:20 +0100
              Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 18:50 +0100
                Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-20 19:10 +0100
                  Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 19:30 +0100
                Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 19:50 +0100
                Re: Root password strength Lee <ler762@gmail.com> - 2024-03-20 20:50 +0100
                  Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 21:00 +0100
                    Re: Root password strength Lee <ler762@gmail.com> - 2024-03-20 21:30 +0100
            Re: Root password strength <tomas@tuxteam.de> - 2024-03-20 18:50 +0100
              Re: Root password strength John Hasler <john@sugarbit.com> - 2024-03-20 19:50 +0100
          Re: Root password strength "Alexander V. Makartsev" <avbetev@gmail.com> - 2024-03-21 20:40 +0100
            Re: Root password strength Jan Krapivin <daydreamer199005@gmail.com> - 2024-03-22 11:00 +0100
              Re: Root password strength Joe <joe@jretrading.com> - 2024-03-22 12:00 +0100
              Re: Root password strength "Alexander V. Makartsev" <avbetev@gmail.com> - 2024-03-22 13:30 +0100
                Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-23 10:50 +0100
              Re: Root password strength Lee <ler762@gmail.com> - 2024-03-23 01:10 +0100
                Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-23 11:30 +0100
        Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 16:50 +0100
      Re: Root password strength John Hasler <john@sugarbit.com> - 2024-03-20 17:00 +0100
        Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 17:10 +0100
          Re: Root password strength Jeffrey Walton <noloader@gmail.com> - 2024-03-20 17:30 +0100
            Re: Root password strength Max Nikulin <manikulin@gmail.com> - 2024-03-20 17:50 +0100
            Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 18:00 +0100
              Re: Root password strength Jeffrey Walton <noloader@gmail.com> - 2024-03-20 18:40 +0100
                Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 18:50 +0100
                  Re: Root password strength Jeffrey Walton <noloader@gmail.com> - 2024-03-20 19:20 +0100
                    Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 19:40 +0100
                      Re: Root password strength Jeffrey Walton <noloader@gmail.com> - 2024-03-20 21:20 +0100
                      Re: Root password strength Curt <curty@free.fr> - 2024-03-21 17:50 +0100
                  Re: Root password strength John Hasler <john@sugarbit.com> - 2024-03-20 19:40 +0100
                    Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 19:50 +0100
          Re: Root password strength John Hasler <john@sugarbit.com> - 2024-03-20 17:30 +0100
            Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 18:00 +0100
          Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-20 19:20 +0100
        Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-20 17:10 +0100

Page 2 of 4 — ← Prev page 1 [2] 3 4  Next page →

#268404

On 19 Mar 2024 17:42 +0300, from daydreamer199005@gmail.com (Jan Krapivin):
> The thing is my password is very easy now, and i haven't thought about
> *"automated
> connection attempts"*, that sounds rather... scary? My password is easy
> because i am not afraid of direct physical access to the computer.
> 
> But... if there is a serious network danger, then i should change my
> password of course. But how strong it should be? If we speak about network
> attacks... it should be like 32 symbols with special symbols? Or this
> paragraph in a handbook is rather paranoid?
> 
> I have activated sudo now for my regular user. Can it (password of regular
> user) be less sophisticated than root password? Because it would be rather
> difficult to enter 32 symbols every time i wake my PC after suspend.

My suggestion for a memorable password is to use a _passphrase_
instead.

I discuss my approach at [1] and to a lesser extent at [2], both of
which you may find worth your while to read through. At [1], the most
relevant section would be the one on passwords you must memorize.

A 6-7 word Diceware passphrase [3] will provide very much adequate
security unless your threat model includes a nation-state government
brute-forcing your password; which chances are it doesn't. I recommend
using the EFF's long word list [4], but any "five dice" (7776 entries)
Diceware word list will provide equivalent security when used with a
word separator. (Unless using a word list deliberately designed for
that use case, Diceware passphrases have reduced security when used
without a word separator. The EFF long word list takes this into
account and therefore doesn't strictly require word separators to
achieve the intended degree of security.)

Two examples of such passphrases are: pedometer settling stretch
endocrine elusive unpaid rented; or: valiant overtime last drab carol
landslide supper. (Naturally, please don't use either of these.) The
xkcd example [5] is: correct horse battery staple; but four words is
relatively weak.

Such a 7-word Diceware passphrase has roughly equivalent strength
(about 90 bits' worth) to a 15 characters mixed-case alphanumeric
traditional password such as ieraey6Wic1Shoh, or an 18 characters
single-case alphanumeric password such as gav7it7aetiengo9ei; but is
arguably much easier to remember and type.

Even a 6-word Diceware passphrase (about 77 bits' worth of security)
will virtually guarantee that the weak link in your security will not
be your account password, yet if you are a reasonably good typist can
be typed accurately in a few seconds with a bit of practice. Also,
many variations of [6] apply. Technical protective measures can only
go so far, BUT that doesn't mean that they are useless; far from it.

For most values of "you", most attackers don't care about _your_
account, or _your_ system; they care about _any_ account, or _any_
system. Actually targeted attacks do happen, but very rarely compared
to what might be thought of as attackers throwing stuff at the wall
and seeing what sticks. (There's even a term for that: Internet
background noise.)

So _even more important is probably to keep your system up to date on
software._ Install updated versions of packages promptly as they
become available in the Debian repositories. If you have any
out-of-tree packages installed, make sure to set up so that you get
notified of updates to those. Software bugs, especially but not
exclusively in software that is exposed to the network in any way
shape or form (this very much includes something like your web
browser), is likely a bigger risk to most people than is a halfway
decent password being brute-forced over the network.


 [1]: https://michael.kjorling.se/password-tips/
 [2]: https://michael.kjorling.se/blog/2023/forget-what-everyone-tells-you-makes-a-password-strong/
 [3]: https://www.diceware.com/
 [4]: https://www.eff.org/deeplinks/2016/07/new-wordlists-random-passphrases
 [5]: https://xkcd.com/936/
 [6]: https://xkcd.com/538/

-- 
Michael Kjörling                     🔗 https://michael.kjorling.se
“Remember when, on the Internet, nobody cared that you were a dog?”

[toc] | [prev] | [next] | [standalone]

#268408

Michael Kjörling <2695bd53d63c@ewoof.net> wrote:

> For most values of "you", most attackers don't care about _your_
> account, or _your_ system; they care about _any_ account, or _any_
> system. Actually targeted attacks do happen, but very rarely compared
> to what might be thought of as attackers throwing stuff at the wall
> and seeing what sticks. (There's even a term for that: Internet
> background noise.)

There's increasing an extra channel available to attackers - namely
'smart' things, or the IoT. For example, many people have a 'smart' TV
that they allow to connect to the Internet so they can use various
streaming services. Each of those services, plus the TV manufacturer,
then becomes a potential point of attack into your system. Similarly
people have security cameras and doorbells connected to the Internet
and even things like fridges and washing machines! Any such device can
be compromised and used to attack computers or door locks or whatever.

[toc] | [prev] | [next] | [standalone]

#268430

[Multipart message — attachments visible in raw view] — view raw

Jan Krapivin <daydreamer199005@gmail.com> wrote on 19/03/2024 at 15:42:55+0100:

> I read Debian Administrator's handbook now. And there are such words: 
>
>  The root user's password should be long (12 characters or more) and
>  impossible to guess. Indeed, any computer (and a fortiori any server)
>  connected to the Internet is regularly targeted by automated
>  connection attempts with the most obvious passwords.  Sometimes it
>  may even be subject to dictionary attacks, in which many combinations
>  of words and numbers are tested as password.  Avoid using the names
>  of children or parents, dates of birth, etc.: many of your co-workers
>  might know them, and you rarely want to give them free access to the
>  computer in question.
>
> The thing is my password is very easy now, and i haven't thought about
> "automated connection attempts", that sounds rather... scary?  My
> password is easy because i am not afraid of direct physical access to
> the computer.
>
> But... if there is a serious network danger, then i should change my
> password of course. But how strong it should be? If we speak about
> network attacks...

Any machine accessible through network connection could be more exposed
due to an overly simple user password. This is more true for root as
it's a well-known username (no need to guess the username) and it has
inherent full privileges in classic GNU/Linux distros.

> it should be like 32 symbols with special symbols?  Or this paragraph
> in a handbook is rather paranoid?

It's not paranoid.

> I have activated sudo now for my regular user. Can it (password of
> regular user) be less sophisticated than root password? Because it
> would be rather difficult to enter 32 symbols every time i wake my PC
> after suspend.

Have a read at https://xkcd.com/936/

Strength of password increases far more with their length than their
complexity.

A phrase you will easily remember but that would be hardcore to guess
through social engineering is perfect.

If you're weird as I am, and used to remember 20+-character-long random
password with symbols yadda yadda, then it's fine, too.

Also you could invest in a security token and configure pam_u2f for
root, but it seems overkill for basic users.

-- 
PEB

[toc] | [prev] | [next] | [standalone]

#268432

On 20 Mar 2024 15:45 +0100, from peb@debian.org (Pierre-Elliott Bécue):
>> it should be like 32 symbols with special symbols?  Or this paragraph
>> in a handbook is rather paranoid?
> 
> It's not paranoid.

For 82 symbols (mixed-case alphanumeric plus 20 special characters),
32 characters is equivalent to about 203 bits. (82^32 ~ 2^203 or,
expressed differently, log_2(82^32) ~ 203.)

At a rate of 2^50 guesses per second, that will take about 3.6*10^38
_years_ to go through. A widely agreed-upon figure for the age of the
universe is around 1.4*10^10 years. Therefore such a password would
take, very roughly, 10^28 times the age of the universe to brute
force.

Of course, with only 32 characters actually chosen, the character set
size can in principle be reduced to 32, yielding 32^32 = 2^160
possibilities. At the same rate, that would take about 4.1*10^25
years; a measly 10^15 times the age of the universe.

I sincerely doubt that guessability of such a password will be the
weak link in overall system security.

-- 
Michael Kjörling                     🔗 https://michael.kjorling.se
“Remember when, on the Internet, nobody cared that you were a dog?”

[toc] | [prev] | [next] | [standalone]

#268433

[Multipart message — attachments visible in raw view] — view raw

I must mention that "32 characters" is only my guess.

In the Handbook it is said: "The root user's password should be long (12
characters or more) and impossible to guess."

Also, i must again say that in my case we speak just about a humble home
desktop, without a ""ssh" access"" or whatever complicated.

Thank you for your answers and tips. I will make a very strong password for
root and a strong one for  a user in the sudo group.

[toc] | [prev] | [next] | [standalone]

#268438

Use one of the password generating programs such as pwgen to produce a
12 character random password.  Write it down.
-- 
John Hasler 
john@sugarbit.com
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]

#268439

[Multipart message — attachments visible in raw view] — view raw

John Hasler <john@sugarbit.com> wrote on 20/03/2024 at 17:02:41+0100:

> Use one of the password generating programs such as pwgen to produce a
> 12 character random password.  Write it down.

Most of the time, writing down a password is a very bad idea.

-- 
PEB

[toc] | [prev] | [next] | [standalone]

#268450

[Multipart message — attachments visible in raw view] — view raw

Brad Rogers <brad@fineby.me.uk> wrote on 20/03/2024 at 18:39:30+0100:
> On Wed, 20 Mar 2024 17:09:31 +0100
> Pierre-Elliott Bécue <peb@debian.org> wrote:
>
> Hello Pierre-Elliott,
>
>>Most of the time, writing down a password is a very bad idea.
>
> Not in your own home.  And in any event, it depends where one keeps that
> 'written down' password.
>
> And if it *does* become an issue at home, you've got bigger, more
> immediate, problems to deal with;  Of the intruder variety.

You have a rather bad cybersecurity approach. And you did not do a
proper risk assessment.

-- 
PEB

[toc] | [prev] | [next] | [standalone]

#268452

On 20 Mar 2024 18:46 +0100, from peb@debian.org (Pierre-Elliott Bécue):
>>> Most of the time, writing down a password is a very bad idea.
>> 
>> Not in your own home.  And in any event, it depends where one keeps that
>> 'written down' password.
>> 
>> And if it *does* become an issue at home, you've got bigger, more
>> immediate, problems to deal with;  Of the intruder variety.
> 
> You have a rather bad cybersecurity approach. And you did not do a
> proper risk assessment.

"Writing a password down" can also be known as "using a password
manager".

Which I would say is _solid_ advice for just about everyone, because
if you're doing passwords properly and have any kind of Internet
presence, you have essentially no chance of remembering every last
one.

The requirement being, of course, that you use a trustworthy password
manager and a _very good_ password database protection passphrase.

Learning a handful of strong passwords that you use regularly (FDE
unlocking, login, password manager, maybe another set of those for
work, and perhaps a few others) is perfectly reasonable, especially if
you aren't arbitrarily forced to change them every few months.
Committing _every_ password to memory is completely impractical.

-- 
Michael Kjörling                     🔗 https://michael.kjorling.se
“Remember when, on the Internet, nobody cared that you were a dog?”

[toc] | [prev] | [next] | [standalone]

#268455

[Multipart message — attachments visible in raw view] — view raw

Michael Kjörling <2695bd53d63c@ewoof.net> wrote on 20/03/2024 at 19:04:10+0100:

> On 20 Mar 2024 18:46 +0100, from peb@debian.org (Pierre-Elliott Bécue):
>>>> Most of the time, writing down a password is a very bad idea.
>>> 
>>> Not in your own home.  And in any event, it depends where one keeps that
>>> 'written down' password.
>>> 
>>> And if it *does* become an issue at home, you've got bigger, more
>>> immediate, problems to deal with;  Of the intruder variety.
>> 
>> You have a rather bad cybersecurity approach. And you did not do a
>> proper risk assessment.
>
> "Writing a password down" can also be known as "using a password
> manager".

In that case it's "type it down". "Write it down" is not really open to
ambiguity.

> Which I would say is _solid_ advice for just about everyone, because
> if you're doing passwords properly and have any kind of Internet
> presence, you have essentially no chance of remembering every last
> one.
>
> The requirement being, of course, that you use a trustworthy password
> manager and a _very good_ password database protection passphrase.
>
> Learning a handful of strong passwords that you use regularly (FDE
> unlocking, login, password manager, maybe another set of those for
> work, and perhaps a few others) is perfectly reasonable, especially if
> you aren't arbitrarily forced to change them every few months.
> Committing _every_ password to memory is completely impractical.

Ok, so you reply to threads without actually reading them?
-- 
PEB

[toc] | [prev] | [next] | [standalone]

#268459

[Multipart message — attachments visible in raw view] — view raw

Brad Rogers <brad@fineby.me.uk> wrote on 20/03/2024 at 19:03:48+0100:

> [[PGP Signed Part:No public key for 0F3EE001F02A3E20 created at 2024-03-20T19:03:48+0100 using RSA]]
> On Wed, 20 Mar 2024 18:46:04 +0100
> Pierre-Elliott Bécue <peb@debian.org> wrote:
>
> Hello Pierre-Elliott,
>
>>You have a rather bad cybersecurity approach.
>
> I use password generators and vaults for all my passwords.  Nothing
> wrong with my cyber-security.

When you state that something like "writing down" a password is
reasonable in one's home as if this actual home were a heaven of safety,
I beg to differ.

Happy to know you actually have a more sensible approach in practice.

That being said, your root password might be needed in situations where
a vault is not accessible yet (let's say your laptop is in a bad
shape). So a vault can not be enough.

> Also note that I put 'written down' in single quotes - it was meant to
> indicate that the term could be a euphemism for such things as stored in
> a password vault, a secure note on a mobile phone, and so on.

It's not the original point of the thread, so while I can understand and
agree your understanding of "written down" not including a paper or
paperbook, it was clearly not the understanding of the initial post.

I guess I'll leave things there for good, anyway, people will do
whatever they think is best, regardless of cyber-security concerns.

-- 
PEB

[toc] | [prev] | [next] | [standalone]

#268461

On Wed, Mar 20, 2024 at 1:47 PM Pierre-Elliott Bécue <peb@debian.org> wrote:
>
> Brad Rogers <brad@fineby.me.uk> wrote on 20/03/2024 at 18:39:30+0100:
> > On Wed, 20 Mar 2024 17:09:31 +0100
> > Pierre-Elliott Bécue <peb@debian.org> wrote:
> >
> > Hello Pierre-Elliott,
> >
> >>Most of the time, writing down a password is a very bad idea.
> >
> > Not in your own home.  And in any event, it depends where one keeps that
> > 'written down' password.
> >
> > And if it *does* become an issue at home, you've got bigger, more
> > immediate, problems to deal with;  Of the intruder variety.
>
> You have a rather bad cybersecurity approach. And you did not do a
> proper risk assessment.

The OP said
- My password is easy because i am not afraid of direct physical
access to the computer.

That seems like a good enough risk assessment to me, but please
explain what you think is "a proper risk assessment."

Thanks,
Lee

[toc] | [prev] | [next] | [standalone]

#268462

De : Lee <ler762@gmail.com>
À : Pierre-Elliott Bécue <peb@debian.org>
Cc : Debian Users ML <debian-user@lists.debian.org>
Date : 20 mars 2024 20:40:52
Objet : Re: Root password strength

> On Wed, Mar 20, 2024 at 1:47 PM Pierre-Elliott Bécue <peb@debian.org> wrote:
>> 
>> Brad Rogers <brad@fineby.me.uk> wrote on 20/03/2024 at 18:39:30+0100:
>>> On Wed, 20 Mar 2024 17:09:31 +0100
>>> Pierre-Elliott Bécue <peb@debian.org> wrote:
>>> 
>>> Hello Pierre-Elliott,
>>> 
>>>> Most of the time, writing down a password is a very bad idea.
>>> 
>>> Not in your own home.  And in any event, it depends where one keeps that
>>> 'written down' password.
>>> 
>>> And if it *does* become an issue at home, you've got bigger, more
>>> immediate, problems to deal with;  Of the intruder variety.
>> 
>> You have a rather bad cybersecurity approach. And you did not do a
>> proper risk assessment.
> 
> The OP said
> - My password is easy because i am not afraid of direct physical
> access to the computer.
> 
> That seems like a good enough risk assessment to me, but please
> explain what you think is "a proper risk assessment."
> 
> Thanks,
> Lee

As stated elsewhere, I am done with this thread. Therefore I do not intend to reply here.

If you still want an answer I am happy to reply privately.

-- 
Pierre-Elliott Bécue

[toc] | [prev] | [next] | [standalone]

#268464

On Wed, Mar 20, 2024 at 3:50 PM Pierre-Elliott Bécue wrote:
>
> De : Lee
> À : Pierre-Elliott Bécue
> Cc : Debian Users ML <debian-user@lists.debian.org>
> Date : 20 mars 2024 20:40:52
> Objet : Re: Root password strength
>
> > On Wed, Mar 20, 2024 at 1:47 PM Pierre-Elliott Bécue  wrote:
> >>
> >> Brad Rogers wrote on 20/03/2024 at 18:39:30+0100:
> >>> On Wed, 20 Mar 2024 17:09:31 +0100
> >>> Pierre-Elliott Bécue wrote:
> >>>
> >>> Hello Pierre-Elliott,
> >>>
> >>>> Most of the time, writing down a password is a very bad idea.
> >>>
> >>> Not in your own home.  And in any event, it depends where one keeps that
> >>> 'written down' password.
> >>>
> >>> And if it *does* become an issue at home, you've got bigger, more
> >>> immediate, problems to deal with;  Of the intruder variety.
> >>
> >> You have a rather bad cybersecurity approach. And you did not do a
> >> proper risk assessment.
> >
> > The OP said
> > - My password is easy because i am not afraid of direct physical
> > access to the computer.
> >
> > That seems like a good enough risk assessment to me, but please
> > explain what you think is "a proper risk assessment."
> >
> > Thanks,
> > Lee
>
> As stated elsewhere, I am done with this thread. Therefore I do not intend to reply here.
>
> If you still want an answer I am happy to reply privately.

Yes, I would like an answer.  I've got passwords written down at home,
so I started thinking about it and I'm much more concerned about other
papers I have at home like bank statements etc. that could do much
more damage to me if they ended up in the wrong hands than a password
to an AP

Thanks
Lee

[toc] | [prev] | [next] | [standalone]

#268449

[Multipart message — attachments visible in raw view] — view raw

On Wed, Mar 20, 2024 at 11:02:41AM -0500, John Hasler wrote:
> Use one of the password generating programs such as pwgen to produce a
> 12 character random password.  Write it down.

Actually, I use between pwgen -n 8 (user pw) and pwgen -n 16 (LUKS encryption).
I memorize the most important of them. The older I get, the easier it gets
(surprisingly :-)

Cheers
-- 
t

[toc] | [prev] | [next] | [standalone]

#268460

tomas writes:
> Actually, I use between pwgen -n 8 (user pw) and pwgen -n 16 (LUKS
> encryption).

-n is the default for pwgen.  Note that this slightly reduces the size
of the search space.  Unfortunately many sites require it.

> I memorize the most important of them.

I memorize the ones I use most often through use.
-- 
John Hasler 
john@sugarbit.com
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]

#268470

[Multipart message — attachments visible in raw view] — view raw

On 20.03.2024 20:28, Jan Krapivin wrote:
> I must mention that "32 characters" is only my guess.
>
> In the Handbook it is said: "The root user's password should be long 
> (12 characters or more) and impossible to guess."
>
> Also, i must again say that in my case we speak just about a humble 
> home desktop, without a ""ssh" access"" or whatever complicated.
>
> Thank you for your answers and tips. I will make a very strong 
> password for root and a strong one for  a user in the sudo group.
This conclusion seems less than optimal to me.
By condemning yourself to type 12+ character password every time you 
'sudo' would really hurt accessibility and usability of your home 
computer and for no good reason.

If we focus solely on your use case: a login security of a PC at home, 
without remote access, then password of your sudo user could be as short and
simple as four numbers, of course unrelated to your date of birth, phone 
number, or any other easily guessable sequence of numbers, like '1234'.
And to prevent guessing password by "bruteforce" you will need to 
restrict number of allowed login attempts.
This could be done by enabling and configuring PAM module. ( man 
pam_faillock )
If configured correctly after a few failed login attempts user will be 
locked out for a configured amount of time and will be unlocked 
automatically once time passes.

Also think about this scenario: a visitor or relative will get physical 
access to your PC and will be able to type on keyboard, reboot it, 
access USB ports, etc.
If perpetrator could do all that, long passwords won't save you, because 
it is easy to reset passwords or add a new sudo user without knowing any 
passwords.
This could be done by simply booting to live OS on USB drive and 
'chroot' into filesystem of your OS.

To defend from this scenario you need to have encrypted filesystem with 
a strong password and never leave your PC with logged in session.
Logged in user session could be used by hackers in theory and practice 
to exploit a known (unpatched) or an unknown (0-day) vulnerability and 
escalate user privileges.
Of course, these hackers have to come into your house first. :)


-- 
With kindest regards, Alexander.

⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org
⠈⠳⣄⠀⠀⠀⠀

[toc] | [prev] | [next] | [standalone]

#268482

[Multipart message — attachments visible in raw view] — view raw

чт, 21 мар. 2024 г. в 22:34, Alexander V. Makartsev <avbetev@gmail.com>:

> This conclusion seems less than optimal to me.
> By condemning yourself to type 12+ character password every time you
> 'sudo' would really hurt accessibility and usability of your home computer
> and for no good reason.
>
> If we focus solely on your use case: a login security of a PC at home,
> without remote access, then password of your sudo user could be as short and
> simple as four numbers, of course unrelated to your date of birth, phone
> number, or any other easily guessable sequence of numbers, like '1234'.
>

Are you speaking only about sudo or root password also?

The thing that bothers me are words: "*any* computer (and a fortiori any
server) connected to the Internet

* is regularly targeted by automated connection attempts"*
I am not tech-savvy. Can you say with 100% (90%?) confidence that there is
no such thing? That home PC without SSH and whatever complicated is safe
(rather safe) from "

*automated connection attempts"?*
This thread reminded of that topic -
https://forums.debian.net/viewtopic.php?t=154002

[toc] | [prev] | [next] | [standalone]

#268484

On Fri, 22 Mar 2024 12:57:20 +0300
Jan Krapivin <daydreamer199005@gmail.com> wrote:

> чт, 21 мар. 2024 г. в 22:34, Alexander V. Makartsev
> <avbetev@gmail.com>:
> 
> > This conclusion seems less than optimal to me.
> > By condemning yourself to type 12+ character password every time you
> > 'sudo' would really hurt accessibility and usability of your home
> > computer and for no good reason.
> >
> > If we focus solely on your use case: a login security of a PC at
> > home, without remote access, then password of your sudo user could
> > be as short and simple as four numbers, of course unrelated to your
> > date of birth, phone number, or any other easily guessable sequence
> > of numbers, like '1234'. 
> 
> Are you speaking only about sudo or root password also?
> 
> The thing that bothers me are words: "*any* computer (and a fortiori
> any server) connected to the Internet
> 
> * is regularly targeted by automated connection attempts"*
> I am not tech-savvy. Can you say with 100% (90%?) confidence that
> there is no such thing? That home PC without SSH and whatever
> complicated is safe (rather safe) from "
> 
> *automated connection attempts"?*
> This thread reminded of that topic -
> https://forums.debian.net/viewtopic.php?t=154002

Most people connect to the Net through a router, usually supplied by
the ISP. By default, that router should not permit any connection
attempts. It is worth checking its configuration, in case some
'helpful' supplier has enabled uPnP 'to make it easier to play online
games'. If so, turn it off. 

Make sure router management is not permitted from the WAN side. Some
ISPs expect to be able to access the router from the Net, something
which should be discouraged.

If you haven't already, change the admin password from the default,
though you probably won't be able to change the account name.

If you use wi-fi, then use the best security your router and clients
can deal with, usually WPA2. If you don't use wi-fi, turn it off at the
router.

Really, with a router in its factory default condition, nothing from
outside should ever get as far as your computer. The problems don't
usually start until you want to run some kind of server software which
is accessible from outside, which must then be appropriately secured.

The main security issues, of course, come from connections you have
invited into your computer, malicious email and web pages. All you can
do to mitigate those threats is to be sensible and careful.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#268486

[Multipart message — attachments visible in raw view] — view raw

On 22.03.2024 14:57, Jan Krapivin wrote:
>
>
> чт, 21 мар. 2024 г. в 22:34, Alexander V. Makartsev <avbetev@gmail.com>:
>
>     This conclusion seems less than optimal to me.
>     By condemning yourself to type 12+ character password every time
>     you 'sudo' would really hurt accessibility and usability of your
>     home computer and for no good reason.
>
>     If we focus solely on your use case: a login security of a PC at
>     home, without remote access, then password of your sudo user could
>     be as short and
>     simple as four numbers, of course unrelated to your date of birth,
>     phone number, or any other easily guessable sequence of numbers,
>     like '1234'.
>
>
> Are you speaking only about sudo or root password also?
>
Dealing with root password could be tricky and you have three options:
1. You can implement the same 'faillock' scheme for root user as well 
and make root password shorter for convenience.
     Pro: 3 failed login attempts and root user will be locked for a 
time period.
     Con: You or somebody can (un)intentionally lock out root user for a 
time period.
2. You can set good password (12+ symbols) for root user without 
'faillock' scheme.
     Pro: You will be always able to login as root user.
     Con: Typing 12+ symbols password could be a headache.
3. You can unset (delete) root user password and lock the account.
     Pro: Nobody will be able to login as root user directly. Instead 
you will have to rely on sudo user to gain root privileges.
     Con: You will have to keep sudo account safe and set shorter lockup 
time period or make another sudo user as backup.

If you prefer to have root user as failsafe, to fix system when you 
screw something up. I suggest to go for option 2 and keep it simple.

> The thing that bothers me are words: "*_any_* computer (and a fortiori 
> any server) connected to the Internet*_is regularly targeted by 
> automated connection attempts"
> _*
> I am not tech-savvy. Can you say with 100% (90%?) confidence that 
> there is no such thing? That home PC without SSH and whatever 
> complicated is safe (rather safe) from "*_automated connection attempts"?
> _*
> This thread reminded of that topic - 
> https://forums.debian.net/viewtopic.php?t=154002
> *_
> _*
That statement is not entirely true, because it depends on a method how 
a PC is connected to the Internet. There are three options:
1. Your PC is connected to Local Area Network (LAN) and there is a 
router/firewall device between your PC and the Internet cord.
     In this case any unsolicited Internet traffic (automated 
connections, port scans, etc) will be stopped by router/firewall device.
     This is because of how IPv4 network address translation (NAT) 
works, to allow multiple LAN hosts to connect to Internet with single IP 
address assigned by Internet Service Provider (ISP).
     In case you would want some traffic to reach your PC through a 
router/firewall device, you will have to configure a rule and allow it 
on router/firewall device.
2. Your PC is connected to a router device that works as a network 
bridge and your PC has public IP address assigned by ISP.
     In this case any unsolicited Internet traffic (automated 
connections, port scans, etc) will reach your PC and should be stopped 
by a firewall.
3. Your PC is connected to Internet cord directly and PC has public IP 
address assigned by ISP.
     In this case any unsolicited Internet traffic (automated 
connections, port scans, etc) will reach your PC and should be stopped 
by a firewall.

In cases 2 and 3 you have to keep firewall up and configured to block 
incoming traffic. Also you have to be aware of any active network 
services on your PC that could be accessed from the Internet and it is 
your job to keep them secure.
These services could be anything: SSH server, FTP server, HTTP server, 
SQL server, SAMBA server, game servers, etc.

In case 1 you are relatively safe from Internet traffic noise. Hosts on 
your LAN are separated from the Internet by router/firewall device.

Now, I don't want to scaremonger and feed anyone's paranoia, but for the 
sake of completion, there are known cases in history when 
router/firewall had vulnerabilities, or firmware flaws, or configuration 
negligence, that allowed perpetrators to 'hack' them, as in gain full 
access and control over their firmware and gain network access to LAN hosts.
These cases are extremely rare nowadays and very hard to pull off 
successfully, especially if the device owner keeps firmware up-to-date 
and configuration tidy.

I hope this helps you to understand a little more how networking works 
under the hood and while there is indeed a network traffic noise 
reaching every second every host on the Internet, 99.99% of it simply 
dropped by firewalls, ISP filters, or fail otherwise.


-- 
With kindest regards, Alexander.

⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org
⠈⠳⣄⠀⠀⠀⠀

[toc] | [prev] | [next] | [standalone]

Page 2 of 4 — ← Prev page 1 [2] 3 4  Next page →

Back to top | Article view | linux.debian.user

csiph-web