Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #202361 > unrolled thread

Password policy.

Back to article view | Back to linux.debian.user

Contents

  Password policy. peter@easthope.ca - 2018-11-13 18:10 +0100
    Re: Password policy. Reco <recoverym4n@enotuniq.net> - 2018-11-13 18:30 +0100
    Re: Password policy. Gene Heskett <gheskett@shentel.net> - 2018-11-13 18:50 +0100
      Re: Password policy. Reco <recoverym4n@enotuniq.net> - 2018-11-13 20:10 +0100
        Re: Password policy. Gene Heskett <gheskett@shentel.net> - 2018-11-13 22:50 +0100
          Re: Password policy. Reco <recoverym4n@enotuniq.net> - 2018-11-14 05:40 +0100
      Re: Password policy. peter@easthope.ca - 2018-11-13 21:00 +0100
        Re: Password policy. Dan Ritter <dsr@randomstring.org> - 2018-11-13 21:10 +0100
        Re (2): Password policy. peter@easthope.ca - 2018-11-13 22:20 +0100
          Re: Re (2): Password policy. Reco <recoverym4n@enotuniq.net> - 2018-11-14 05:40 +0100
    Re: Password policy. Brian <ad44@cityscape.co.uk> - 2018-11-13 19:20 +0100
    Re: Password policy. Jude DaShiell <jdashiel@panix.com> - 2018-11-13 19:40 +0100
      Re: Password policy. Reco <recoverym4n@enotuniq.net> - 2018-11-13 20:10 +0100
        Re: Password policy. Brian <ad44@cityscape.co.uk> - 2018-11-13 21:20 +0100
          Re: Password policy. peter@easthope.ca - 2018-11-14 03:40 +0100
    Re: Password policy. peter@easthope.ca - 2018-11-14 04:10 +0100
      Re: Password policy. Brian <ad44@cityscape.co.uk> - 2018-11-14 10:50 +0100
        Re: Password policy. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-11-14 11:30 +0100
          Re: Password policy. Corey Manshack <corey@manshack.me> - 2018-11-14 11:40 +0100
            Re: Password policy. Corey Manshack <corey@manshack.me> - 2018-11-14 12:30 +0100
              Re: Password policy. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-11-14 12:30 +0100
                Re: Password policy. Corey Manshack <corey@manshack.me> - 2018-11-14 13:20 +0100
                  Re: Password policy. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-11-14 15:30 +0100
                    Re: Password policy. Brad Rogers <brad@fineby.me.uk> - 2018-11-14 16:50 +0100
            Re: Password policy. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-11-14 12:30 +0100
          Re: Password policy. Brian <ad44@cityscape.co.uk> - 2018-11-14 12:20 +0100
            Re: Password policy. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-11-14 15:40 +0100
              Re: Password policy. Brian <ad44@cityscape.co.uk> - 2018-11-14 17:00 +0100
                Re: Password policy. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-11-14 17:50 +0100
                  Re: Password policy. Brian <ad44@cityscape.co.uk> - 2018-11-14 21:30 +0100
                Re: Password policy. Richard Hector <richard@walnut.gen.nz> - 2018-11-15 01:10 +0100

Page 1 of 2  [1] 2  Next page →

#202361 — Password policy.

Hi, 

https://www.debian.org/doc/manuals/debian-reference/ch04.en.html#_good_password
specifies "6 to 8 characters".  Is that adequate against currently available brute force?

Thanks,                                  ... Peter E.



-- 
Message composed and transmitted by software designed to avoid the 
complication, overhead and vulnerability of antivirus software.

123456789 123456789 123456789 123456789 123456789 123456789 123456789
Tel: +1 360 639 0202                                  +1 
http://easthope.ca/Peter.html              Bcc: peter at easthope. ca

[toc] | [next] | [standalone]

#202362

	Hi.

On Tue, Nov 13, 2018 at 08:23:13AM -0800, peter@easthope.ca wrote:
> Hi, 
> 
> https://www.debian.org/doc/manuals/debian-reference/ch04.en.html#_good_password
> specifies "6 to 8 characters".  Is that adequate against currently available brute force?

$ hashcat --session 6to8 -m1800 /tmp/hash -a3 ?a?a?a?a?a?a

hashcat (v4.2.1) starting...

OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 1060 3GB, 753/3013 MB allocatable, 9MCU

...

Session..........: 6to8
Status...........: Running
Hash.Type........: sha512crypt $6$, SHA512 (Unix)
Hash.Target......: $6$...
...
Time.Estimated...: Tue Aug 11 17:56:28 2020 (1 year, 271 days)
Guess.Mask.......: ?a?a?a?a?a?a [6]

$ hashcat --session 6to8 -m1800 /tmp/hash -a3 ?a?a?a?a?a?a?a?a

...

Session..........: 6to8
Status...........: Running
Hash.Type........: sha512crypt $6$, SHA512 (Unix)
Hash.Target......: $6$...
...
Time.Estimated...: Next Big Bang (15988 years, 0 days)
Guess.Mask.......: ?a?a?a?a?a?a?a?a [8]


So, 6 characters is somewhat low (that GPU is outdated by today's
standards). 8 characters seem ok.

Reco

[toc] | [prev] | [next] | [standalone]

#202363

On Tuesday 13 November 2018 11:23:13 peter@easthope.ca wrote:

> Hi,
>
> https://www.debian.org/doc/manuals/debian-reference/ch04.en.html#_good
>_password specifies "6 to 8 characters".  Is that adequate against
> currently available brute force?
>
> Thanks,                                  ... Peter E.

"John the ripper" can find a 6 char word in a couple seconds on a slow 
machine. Every char you add multiplies that time by 62 or so depending 
on the valid char spec. 52 for upper and lowercase plus 0-9= 62. Add 13 
more if you allow the punctuation on the upper row of keys shifted, I 
ran into a supplier site still useing 8 chars last summer, and sent them 
a 'gram about it, fussing that I won't do business with such a poorly 
protected site. I got an email from them the next Tuesday proclaiming 
their network guy had expanded the passwd length to 127 chars.  I like 
20+ chars personally as that would take John about the rest of the time 
for the universe to run down to find. But there are better tools for the 
specialists at hacking than John. Please keep that in mind.

-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#202367

On Tue, Nov 13, 2018 at 12:49:17PM -0500, Gene Heskett wrote:
> On Tuesday 13 November 2018 11:23:13 peter@easthope.ca wrote:
> 
> > Hi,
> >
> > https://www.debian.org/doc/manuals/debian-reference/ch04.en.html#_good
> >_password specifies "6 to 8 characters".  Is that adequate against
> > currently available brute force?
> >
> > Thanks,                                  ... Peter E.
> 
> "John the ripper" can find a 6 char word in a couple seconds on a slow 
> machine.

Against sha512? Or against old Unix crypt? There's a difference, and
it's measured in orders of magnitude, not times.

Reco

[toc] | [prev] | [next] | [standalone]

#202372

On Tuesday 13 November 2018 14:01:51 Reco wrote:

> On Tue, Nov 13, 2018 at 12:49:17PM -0500, Gene Heskett wrote:
> > On Tuesday 13 November 2018 11:23:13 peter@easthope.ca wrote:
> > > Hi,
> > >
> > > https://www.debian.org/doc/manuals/debian-reference/ch04.en.html#_
> > >good _password specifies "6 to 8 characters".  Is that adequate
> > > against currently available brute force?
> > >
> > > Thanks,                                  ... Peter E.
> >
> > "John the ripper" can find a 6 char word in a couple seconds on a
> > slow machine.
>
> Against sha512? Or against old Unix crypt? There's a difference, and
> it's measured in orders of magnitude, not times.
>
> Reco

I don't recall as it been a decade or more since I saw that article


-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#202378

	Hi.

On Tue, Nov 13, 2018 at 04:47:39PM -0500, Gene Heskett wrote:
> On Tuesday 13 November 2018 14:01:51 Reco wrote:
> 
> > On Tue, Nov 13, 2018 at 12:49:17PM -0500, Gene Heskett wrote:
> > > On Tuesday 13 November 2018 11:23:13 peter@easthope.ca wrote:
> > > > Hi,
> > > >
> > > > https://www.debian.org/doc/manuals/debian-reference/ch04.en.html#_
> > > >good _password specifies "6 to 8 characters".  Is that adequate
> > > > against currently available brute force?
> > > >
> > > > Thanks,                                  ... Peter E.
> > >
> > > "John the ripper" can find a 6 char word in a couple seconds on a
> > > slow machine.
> >
> > Against sha512? Or against old Unix crypt? There's a difference, and
> > it's measured in orders of magnitude, not times.
> >
> > Reco
> 
> I don't recall as it been a decade or more since I saw that article

So it's either crypt or md5. Debian moved away from both long time ago.
John's too slow for today's hashes as it only utilizes CPU.
If you really need to bruteforce that password you use hashcat - GPU
based.

Reco

[toc] | [prev] | [next] | [standalone]

#202368

*	From: Gene Heskett <gheskett@shentel.net>
*	Date: Tue, 13 Nov 2018 12:49:17 -0500
> "John the ripper" can find a 6 char word in a couple seconds on a slow 
> machine.

We refer to two completely different processes or I completely miss 
the point. After an incorrect password is submitted, the 
authentication process waits a few seconds before allowing another 
try.  Therefore if "John the ripper" is to success in two seconds, the 
correct pw must be submitted on the first try.  That might happen once 
in an astronomical number of different authentications but not 
frequently.  ... Unless magic is involved.  (?)

Regards,                           ... Peter E.

-- 
Message composed and transmitted by software designed to avoid the 
complication, overhead and vulnerability of antivirus software.

123456789 123456789 123456789 123456789 123456789 123456789 123456789
Tel: +1 360 639 0202                                  +1 
http://easthope.ca/Peter.html              Bcc: peter at easthope. ca

[toc] | [prev] | [next] | [standalone]

#202369

peter@easthope.ca wrote: 
> *	From: Gene Heskett <gheskett@shentel.net>
> *	Date: Tue, 13 Nov 2018 12:49:17 -0500
> > "John the ripper" can find a 6 char word in a couple seconds on a slow 
> > machine.
> 
> We refer to two completely different processes or I completely miss 
> the point. After an incorrect password is submitted, the 
> authentication process waits a few seconds before allowing another 
> try.  Therefore if "John the ripper" is to success in two seconds, the 
> correct pw must be submitted on the first try.  That might happen once 
> in an astronomical number of different authentications but not 
> frequently.  ... Unless magic is involved.  (?)

No magic. The login process has delays built in to it. John The
Ripper does its own comparison against the value of the hash
stored in /etc/shadow, not actually invoking login.

-dsr-

[toc] | [prev] | [next] | [standalone]

#202371 — Re (2): Password policy.

From:	peter@easthope.ca
Date:	Tue, 13 Nov 2018 11:39:40 -0800
> We refer to two completely different processes or I completely miss 
> the point. 

Gene, in your scenario the crook has a copy of the hash of the 
password file.  Correct?  No reliable means of testing a 
password without giving away the hashed password file exists?

Regards,              ... Peter E.



-- 
Message composed and transmitted by software designed to avoid the 
complication, overhead and vulnerability of antivirus software.

123456789 123456789 123456789 123456789 123456789 123456789 123456789
Tel: +1 360 639 0202                                  +1 
http://easthope.ca/Peter.html              Bcc: peter at easthope. ca

[toc] | [prev] | [next] | [standalone]

#202379 — Re: Re (2): Password policy.

	Hi.

On Tue, Nov 13, 2018 at 12:55:06PM -0800, peter@easthope.ca wrote:
> Correct?  No reliable means of testing a 
> password without giving away the hashed password file exists?

It's rather 'no fast way of bruteforcing a password without giving away
its hash exists'.
You can always try to feed different passwords to login(1) or ssh, but
it will be terribly slow.

Reco

[toc] | [prev] | [next] | [standalone]

#202364

On Tue 13 Nov 2018 at 08:23:13 -0800, peter@easthope.ca wrote:

> Hi, 
> 
> https://www.debian.org/doc/manuals/debian-reference/ch04.en.html#_good_password
> specifies "6 to 8 characters".  Is that adequate against currently
> available brute force?

Much too fuzzy a question. You are going to have to say what you mean
by "brute force", how it is taking place and against what. The six
letter password "a*isvg" might be good enough when it is someone
sitting in front of the machine trying to get in (the delay between
failed logins can be exasperating). OTOH, if a*isvg is known to be the
name of your dog.......

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#202365

It's not even adequate against rainbow table hash attacks and hasn't
been for several years by now either.

On Tue, 13 Nov 2018, peter@easthope.ca wrote:

> Date: Tue, 13 Nov 2018 11:23:13
> From: peter@easthope.ca
> To: debian-user@lists.debian.org
> Cc: peter@easthope.ca
> Subject: Password policy.
> Resent-Date: Tue, 13 Nov 2018 17:06:10 +0000 (UTC)
> Resent-From: debian-user@lists.debian.org
>
> Hi,
>
> https://www.debian.org/doc/manuals/debian-reference/ch04.en.html#_good_password
> specifies "6 to 8 characters".  Is that adequate against currently available brute force?
>
> Thanks,                                  ... Peter E.
>
>
>
>

-- 

[toc] | [prev] | [next] | [standalone]

#202366

	Hi.

On Tue, Nov 13, 2018 at 01:37:22PM -0500, Jude DaShiell wrote:
> It's not even adequate against rainbow table hash attacks and hasn't
> been for several years by now either.

That's why they using salted hashes for passwords in /etc/shadow for the
last 15 years at least - and it's considered an adequate protection
against Rainbow Tables.
Besides, if the hashing algorithm is that bad that it can be cracked by
Rainbow Tables (the old Unix crypt, for instance) - the password length
is hardly relevant.

Reco

[toc] | [prev] | [next] | [standalone]

#202370

On Tue 13 Nov 2018 at 22:00:00 +0300, Reco wrote:

> 	Hi.
> 
> On Tue, Nov 13, 2018 at 01:37:22PM -0500, Jude DaShiell wrote:
> > It's not even adequate against rainbow table hash attacks and hasn't
> > been for several years by now either.
> 
> That's why they using salted hashes for passwords in /etc/shadow for the
> last 15 years at least - and it's considered an adequate protection
> against Rainbow Tables.
> Besides, if the hashing algorithm is that bad that it can be cracked by
> Rainbow Tables (the old Unix crypt, for instance) - the password length
> is hardly relevant.

Your comments are probably uncontestable. Meanwhile - the OP sits tight
and does not expand on what he wants to defend against. A classic case
of throwing out an idea and sitting back to enjoy the furore without
specifying the conditions he wants fulfilled. Either that of he picks on
one post and goes off at a tangent.

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#202376

*	From: Brian <ad44@cityscape.co.uk>
*	Date: Tue, 13 Nov 2018 20:14:41 +0000
> OP sits tight and does not expand on what he wants to defend against.

To the best of my understanding a password is used to allow legitimate 
access and prevent illegitimate access.  More details in these pages.
https://en.wikipedia.org/wiki/Password
https://www.debian.org/doc/manuals/debian-reference/ch04.en.html#_good_password

> ... what he wants to defend against.

Illegitimate access.  See above.

> ... furore ...

Might be some confusion.  Not sure it's furore.

*	From: Reco <recoverym4n@enotuniq.net>
*	Date: Tue, 13 Nov 2018 20:22:58 +0300
> So, 6 characters is somewhat low (that GPU is outdated by today's
> standards). 8 characters seem ok.

Good.  Thanks Reco.  I'll keep the present 8 characters and not start 
shifting to 9 or 10.

Regards,                             ... Peter E.


-- 
Message composed and transmitted by software designed to avoid the 
complication, overhead and vulnerability of antivirus software.

123456789 123456789 123456789 123456789 123456789 123456789 123456789
Tel: +1 360 639 0202                                  +1 
http://easthope.ca/Peter.html              Bcc: peter at easthope. ca

[toc] | [prev] | [next] | [standalone]

#202377

*	From: Brian <ad44@cityscape.co.uk>
*	Date: Tue, 13 Nov 2018 18:14:32 +0000
> OTOH, if a*isvg is known to be the name of your dog.......

The reference in my enquiry is clear about that.
https://www.debian.org/doc/manuals/debian-reference/ch04.en.html#_good_password
Section 4.3.
"Do not choose guessable words for the password. ...  pets, ... are all bad choice for the password."

> You are going to have to say what you mean
> by "brute force",

https://en.wikipedia.org/wiki/Brute-force_attack

Regards,                        ... Peter E.

-- 
Message composed and transmitted by software designed to avoid the 
complication, overhead and vulnerability of antivirus software.

123456789 123456789 123456789 123456789 123456789 123456789 123456789
Tel: +1 360 639 0202                                  +1 
http://easthope.ca/Peter.html              Bcc: peter at easthope. ca

[toc] | [prev] | [next] | [standalone]

#202388

On Tue 13 Nov 2018 at 18:50:35 -0800, peter@easthope.ca wrote:

> *	From: Brian <ad44@cityscape.co.uk>
> *	Date: Tue, 13 Nov 2018 18:14:32 +0000
> > OTOH, if a*isvg is known to be the name of your dog.......
> 
> The reference in my enquiry is clear about that.
> https://www.debian.org/doc/manuals/debian-reference/ch04.en.html#_good_password
> Section 4.3.
> "Do not choose guessable words for the password. ...  pets, ... are
>  all bad choice for the password."

My comment was a reference to the reference. :)

> > You are going to have to say what you mean
> > by "brute force",
> 
> https://en.wikipedia.org/wiki/Brute-force_attack

Security is already breached if a password database can be attacked in
that way. A six character (upper and lower case) login password would
take about 500 years to force for someone at the keyboard. This assumes
three seconds per try without coffee breaks.

I'm the cautious type, so use ten character passwords.

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#202390

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256



On 14/11/18 8:44 pm, Brian wrote:
> On Tue 13 Nov 2018 at 18:50:35 -0800, peter@easthope.ca wrote:
>> https://en.wikipedia.org/wiki/Brute-force_attack
> 
> Security is already breached if a password database can be attacked
> in that way. A six character (upper and lower case) login password
> would take about 500 years to force for someone at the keyboard.
> This assumes three seconds per try without coffee breaks.
> 
> I'm the cautious type, so use ten character passwords.

Well, yes.... but some breaches are from remote machines that may be
able to life the /etc/shadow file due to a vulnerability that isn't
fixed and if that's all they have, then they don't yet need more
direct access.  If they have /etc/shadow, then they can work on
off-line brute force.

I'm very surprised at the very low password strength / length
recommendations to say the least!

Kind Regards
AndrewM
-----BEGIN PGP SIGNATURE-----

iHUEAREIAB0WIQTJAoMHtC6YydLfjUOoFmvLt+/i+wUCW+v3PQAKCRCoFmvLt+/i
+19JAP9R3Zw7RqQDIytWTedQxVeCKMV0+gGxMAw9oO6G6gG/VgD/dJbL4dppk5Zp
j5Tolqq/w0aa34exUvNHn6fqMI85HhU=
=5zUS
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#202391

If they have /etc/shadow why would they need to brute force :) I can’t think of a vuln that would give that up without them already having root.

Sent from my iPhone

> On Nov 14, 2018, at 6:21 PM, Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> 
> 
>> On 14/11/18 8:44 pm, Brian wrote:
>>> On Tue 13 Nov 2018 at 18:50:35 -0800, peter@easthope.ca wrote:
>>> https://en.wikipedia.org/wiki/Brute-force_attack
>> 
>> Security is already breached if a password database can be attacked
>> in that way. A six character (upper and lower case) login password
>> would take about 500 years to force for someone at the keyboard.
>> This assumes three seconds per try without coffee breaks.
>> 
>> I'm the cautious type, so use ten character passwords.
> 
> Well, yes.... but some breaches are from remote machines that may be
> able to life the /etc/shadow file due to a vulnerability that isn't
> fixed and if that's all they have, then they don't yet need more
> direct access.  If they have /etc/shadow, then they can work on
> off-line brute force.
> 
> I'm very surprised at the very low password strength / length
> recommendations to say the least!
> 
> Kind Regards
> AndrewM
> -----BEGIN PGP SIGNATURE-----
> 
> iHUEAREIAB0WIQTJAoMHtC6YydLfjUOoFmvLt+/i+wUCW+v3PQAKCRCoFmvLt+/i
> +19JAP9R3Zw7RqQDIytWTedQxVeCKMV0+gGxMAw9oO6G6gG/VgD/dJbL4dppk5Zp
> j5Tolqq/w0aa34exUvNHn6fqMI85HhU=
> =5zUS
> -----END PGP SIGNATURE-----
> 

[toc] | [prev] | [next] | [standalone]

#202393

So using the file uploader tool we can inject many more dangerous scripts and codes to gain higher access than just “reading” /etc/shadow if the uploader tool is running as privileged user or we gained privilege escalation another way.

Sent from my iPhone

> On Nov 14, 2018, at 7:20 PM, Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> wrote:
> 
> 
> 
>> On 14/11/18 9:28 pm, Corey Manshack wrote:
>> If they have /etc/shadow why would they need to brute force :) I can’t think of a vuln that would give that up without them already having root.
> 
> A website file uploader tool, apparantly there has been one there for
> about 10 years using jquery.  Once the file is uploaded, it can be
> leveraged to steel other files that the website shouldn't have access to.
> 
> That's just one example.  I'm sure there are many others.
> 
> A.

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.debian.user

csiph-web