HPUX 11.31 Trusted Systems Password File cracked

[Laurent Menase]

Hi,

There is an optional product to have sha512 encryption for shadow passwds ( doesn't work with nis)

https://h20392.www2.hp.com/portal/swdepot/displayInstallInfo.do?productNumber=PHI11i3

Best regards,

[RJHall]

It's for circumstances like these that I wished HP-UX 11i v3 supported PAM libcrack. About all one can do to force stronger local passwords is to use the security(4) features, such as PASSWORD_MIN_type_CHARS.

[James Calfas]

First of all, I would never give a root password to any outside party - even an auditor.  My belief is that just because someone works for an auditing firm doesn't automatically mean that they are trustworthy.  If they need information about the system, they can tell me what they need and I will give it to them.  

As for the issue of cracked passwords, it is important to have rules about password strength.  e.g. minimum length, upper and lower case characters, numeric and special characters, etc.  There is a Wikipedia article "Password Strength" that goes in to the issue in extreme detail.    Perhaps the best way to know that passwords are secure is to periodically copy them into an offline Linux machine and try to crack them with John the Ripper.  Any passwords that get cracked would need to be changed.