The basic form of authentication used to control access to a UNIX
host is a username and password combination. Intruders have
established mechanisms and tools to compromise password information
by leveraging a variety of common problems.
- Weak passwords
Encourage your users to choose passwords that are difficult to guess
(for example, words that are not in any dictionary of any language;
no proper nouns, including names of "famous" real or fictitious
characters; no acronyms that are commonly used by computer
professionals; no simple variations of first or last names.)
Furthermore, inform your users not to leave any cleartext
username/password information in files on any system.
A good heuristic for choosing a password is to choose an
easy-to-remember phrase, such as "By The Dawn's Early Light", and
use the first letters to form a password. Add some punctuation or
mix case letters as well. For the phrase above, one example password
might be: bt}DeL{. (DO NOT use this sample phrase for your
password.)
If intruders can get a password file, they usually move or copy it
to another machine and run password-guessing programs on it. These
programs involve large dictionary searches, and they run quickly
even on slow machines. Most systems that do not put any controls of
the type of passwords used probably have at least one password that
can be easily guessed. CERT Incident Note IN-98.03 describes
intruder activity that is based on a stolen password file.
-
http://www.cert.org/incident_notes/IN-98.03.html
If you believe that your password file may have been taken, change
all the passwords on the system. At the very least, you should
change all system passwords because an intruder may concentrate on
those and may be able to guess even a reasonably "good"
password. Intruders often use compromised accounts to attempt to
gain privelaged access on vulnerable systems, so we encourage you to
follow the steps in
For further information about protecting your system from
password-based attacks, see
- Accounts with default passwords
Intruders exploit system default passwords that have not been
changed since installation, including accounts with vendor-supplied
default passwords. In some cases, accounts do not have a password
assigned by default. CERT Incident Note IN-98.01 describes intruder
activity that is based on exploitations of accounts without
passwords.
-
http://www.cert.org/incident_notes/IN-98.01.irix.html
Be sure to change all default passwords on computer systems and
networking equipment prior to deployment. Also, be aware that
product upgrades can quietly change account passowrds to a new
default. It is best to change the passwords of default accounts
after applying updates.
Scan your password file for extra UID 0 accounts, accounts with no
password, or new entries in the password file. Do not allow any
accounts without passwords. Remove entries for unused accounts from
the password file. To disable an account, change the password field
in the /etc/passwd file to an asterisk '*' and change the login
shell to /bin/false to ensure that an intruder cannot login to the
account from a trusted system on the network.
- Reusable and shared passwords
Even excellent passwords are not safe. They can be captured by
programs such as packet sniffers if the passwords are sent across
networks in cleartext (whether on a subnet, a local network, or
the Internet). It is common for intruders to use packet sniffers
on compromised systems to harvest passwords.
CERT Incident Note IN-99-06 describes widespread intruder activity
involving distributed sniffers used to harvest username and
password information from a network.
-
http://www.cert.org/incident_notes/IN-99-06.html
At the very least, a single password should not be used to protect
multiple accounts. If an intruder is able to compromise a shared
password just once, all of the accounts sharing the password are
compromised. Each account, or resource, protected by a password
should have it's own unique password.
To overcome the threat posed by packet sniffers, we recommend
using one-time passwords, especially for authenticated access from
external networks and for access to sensitive resources like name
servers and routers. For more information, see Appendix B of the
following advisory:
-
http://www.cert.org/advisories/CA-94.01.ongoing.network.monitoring.attacks.html
Another approach is to use a strong authentication mechanisms such
as secure shell, SSL, or kerberos. Secure shell, or ssh, is widely
available for many different platforms. For more information about
secure shell, see