From: Dave Kinchlea <security@kinch.ark.com>
Date: Sun, 17 Nov 1996 13:37:45 -0800 (PST)
To: The Deviant <deviant@pooh-corner.com>
Subject: Re: RFC: A UNIX crypt(3) replacement
In-Reply-To: <Pine.LNX.3.94.961117172527.2314A-100000@random.sp.org>
Message-ID: <Pine.LNX.3.95.961117133536.1181L-100000@kinch.ark.com>
MIME-Version: 1.0
Content-Type: text/plain


On Sun, 17 Nov 1996, The Deviant wrote:

> On Sun, 17 Nov 1996, Adam Shostack wrote:
> > 	A longer salt would make running crack against a large
> > password file slower.
> 
> While thats all well and good, it shouldn't be necisary.  If passwords are
> shadowed, one must have root access before one can run crack against the
> password list, at which time it is innefective.

I couldn't disagree more (not that I necessarily agree or disagree with
Adam's approach). Sure, once you have root you don't need any other
access, until the hole is found and closed that gave root in the first
place. After that, that /etc/shadow file with the lousy passwords (that
seem inevitable with folks using /etc/shadow as they get complacent
with a false sense of security) provide the would-be cracker with a set
of local accounts to (try to) break in again. Local accounts are
definitely an advantage should you be looking for way to break any Unix
variant.

The moral of the story is: ALWAYS ensure that whatever passwords you
have on your unix system are not beatable by crack, don't rely upon
hiding them because if you are wrong you are in it up to your neck!

cheers, kinch