LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
How strictly do your users obey your security policies?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
Emily Ratliff: OS Security
DanWalsh LiveJournal
Security Bloggers Network
Latest Newsletters
Linux Security Week: December 1st, 2008
Linux Advisory Watch: November 28th, 2008
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Linux Password Policies Print E-mail
User Rating:      How can I rate this item?
Source: tuxtraining - Posted by Bill Keys   
Host Security Lets start with some basics…. Our Linux system stores its usernames and passwords in a special file : ‘/etc/password’. The passwords in this file are one way encrypted (hash-ed) through a password encryption function called ‘crypt’ using DES as the encryption algorithm. The good thing about ‘hashing’ is that you can not ‘decrypt’ the hashed passwords because the function used for hashing cannot be reversed (one-way traffic). DES generally uses keys (symmetric key cryptography) in which case things can be either encrypted or decrypted, but for encrypting passwords in Linux, only the ‘hashing’ implementation of DES is used. How much do you know about Linux passwords? This article goes into detail about how user's passwords are controlled and handled in Linux.

Read this full article at tuxtraining

Comments
Oh dear...Written by Beowulf on 2008-09-02 16:35:15
Meaning no disrespect to the author of the article on Tuxtraining, but the article is in serious need of a re-write and fact verification. Linux has used /etc/shadow for passwords for years, and hasn't been restricted by the 8 character limit in ages. While conceptually the article puts forth some good ideas, things like telling the reader to keep passwords less than 8 characters (I suspect the author meant less than or equal to 8 characters), leaves one feeling rather nonplussed.
Just a question...Written by Gitara on 2008-09-03 02:09:42
Can anybody tell me if there is posibility/addon for linux to make a delay (or even lock out) between unsuccessful password attempts (console/ssh/telnet sessions)?
Delaying and lockingWritten by Bas on 2008-09-03 02:18:31
Take a look at pam_tally.
Delaying and lockingWritten by Gitara on 2008-09-03 05:02:59
Thanks Bas for receipe, this is it!

Write Comment
  • Please keep the topic of messages relevant to the subject of the article.
  • Personal verbal attacks will be deleted.
  • Please don't use comments to plug your web site.. Such material will be removed.
Name:
Title:
Comment:

Code:* Code

Powered by AkoComment!

 
< Prev   Next >
    
Partner:

 

Latest Features
A Secure Nagios Server
Never Installed a Firewall on Ubuntu? Try Firestarter
Review: Hacking Exposed Linux, Third Edition
Security Features of Firefox 3.0
Review: The Book of Wireless
April 2008 Open Source Tool of the Month: sudo
Open Source Tool of March: ZoneMinder
Yesterday's Edition
Linux Role in Botnets Studied
10 Mistakes New Linux Administrators Make

QuickLinks: Comunity , HOWTOs , Blogs , Features , Book Reviews , Networking ,
  Security Projects ,   Latest News ,  Newsletters ,  SELinux ,  Privacy ,  Home,
 Hardening ,   About Us,   Advertise,   Legal Notice,   RSS,   Guardian Digital

(c)Copyright 2008 Guardian Digital, Inc. All rights reserved.