Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

My question is if someone hacked privileges on /etc/shadow file , can he crack the passwords of the system users.

If yes , how can i secure more my passwords and how to make it difficult on a cracker to easily crack my users passwords .

Any Suggestion?

share|improve this question

2 Answers 2

While DES should never be used, MD5 is also weak. Check your /etc/login.defs file for the ENCRYPT_METHOD setting. SHA512 is the strongest possible option as far as I know. If your hashes in /etc/shadow start with "$6$", that's SHA512 which I think is not known to be broken (unlike DES and MD5). Of course, strong password hashes do not mean that simple passwords cannot still be easily cracked - they can.

share|improve this answer
1  
It doesn't matter what hash you use; if you have the hash and enough time, and assuming the password is relatively short ( it isn't hundreds of characters long or more ), then you can find it. –  psusi Mar 1 at 5:22
1  
@psusi, The strngth of a password as dervied from it's length is limited to the length (in bytes) of the hash generated. You can't have more entropy then the storage mechanism itself. For example, sha512 hashes are 64 bytes long, so any password, no matter how long, cannot be more secure than 64 bytes would allow. –  Soviero Mar 1 at 7:22
    
@KevinSoviero, the question is not which has more entropy, but how difficult it is to find the password, given the hash. The that is entirely dependent on the time it takes to compute the hash and how complex the password is. The length of the hash only matters if you are looking for a duplicate password that gives the same hash. –  psusi Mar 1 at 19:27
up vote 1 down vote accepted

After research , i can answer this questions :

Can passwords be cracked : Yes

How : by using crack software like : John the Ripper security software which is open source and can be installed easily.

What should be the level of cracker : Newbie , because this software is pretty good and there are plenty of instructions on the net how to use it .

Here is How easy to use it to crack passwords! Link

What should i do to be more secure ?

1) Make sure you use SHA512 on your passwords instead of DES and md5 !
2) Use a password cracker  to filter out weak passwords .
3) Use different passwords on different systems.
4) force users to change their passwords - the root password should be changed even more frequently!
5) Your passwords should be:
At least 8 characters long.
Have at least one number.
Have at least one non-alphanumeric character.
Not consist of a dictionary word.
Have both upper and lower case letters.

References : dankalia

share|improve this answer
    
Maybe... but stormpath.com/blog/5-myths-password-security –  Rmano Mar 1 at 3:23
    
thats what am talking about , i want to learn how to make my system more secured . –  nux Mar 1 at 3:26
2  
@Rmano not sure what that link has to do with this question. nux I think some of the information you posted, most of, is a bit outdated. Ubuntu has not used md5 or des for years. –  bodhi.zazen Mar 1 at 3:41
    
@dankalia answer is OK but I'd change it a bit: 1. Use a random password generator. After a few times of typing it you will memories it. 2. With strong enough, random unshared passwords (I.e. not reused for multiple accounts), I find forcing password resetting to be detrimental, don't do this. 3. Use an encrypted password store (e.g. lastpass, but there are plenty others) to backup the passwords (e.g. just in case you forget, or passwords you don't use so often). –  Amos Shapira Mar 1 at 23:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.