Root password discipline

[Keely Jackson]

Hi John

We appear to have the most zealous password routine here and it is strictly adhered to.

All systems have the same root password, except 2 which have a different one. The password is picked by one of the team members and is something vaguely meaningful, ie not totall gibberish, with either a number of capital letter.

Root and user passwords expire every 28 days.

I suspect the policy is dictated by the auditors. It wouldn't be mine!

Cheers
Keely

[Gavin Clarke]

We too have a fairly draconian policy, originally set up by our IT director.

Passwords for everyone change monthly.
This means that we get quite a few, my password doesn't work calls, it also means I feel a bit less anxious about people trying to crack the root password.

The passwords are generally more on the memorable than random side.

We keep the password in a safe in an envelope, in case either the DBA or I am not available.

[Christian Gebhardt]

Hi

-changing, each time, if a colleague comes or goes
- different root password for each machine
- not machine generated
- completely random
- dictaded from our group

We uses ssh/passphrase to connect to the machines. Really nobody knows the password, except the safe, in which the password is deposited for emergency reasons.

Chris

[Yogeeraj_1]

Hi,

Very nice post indeed, this had pestered my mind a few times ago... :)

How often do you change your root passwords?
->Once every year, afterall very few people have access to it. We are not connected to the internet. We don't use simple codes for passwords. We only create one that can be "rememberable"

Do you keep a different root password for each Unix machine or do you use the same one for multiple machines?
->A different for each server so that we are sure that we are on the right server!!

Do you use a machine generated password with lots of upper and lower case letters, numbers, and special characters?
->We don't use machine generated passwords.

Do you use something that is somewhat easy to remember or are they completely random?
->Not easy to remember but not too difficult too.

Is your password discipline dictated by company/departmental policy or is it determined by you and your group?
->Not dictated by any policy although we have one as per books ;)

Cheers
Yogeeraj

[John Collier]

John,

Company wide, I believe that you would find that the policy is to make all of the systems trusted and to basically use a Nazi type approach. I???m fortunate enough not to be included in this yet, but it would seem as if the Nazis are being assimilated by the Borg at this time and we all know what the Borg plan on doing to everyone. I???m afraid that my time in the minority may be limited ;-(

For now, the root passwords haven???t changed in quite some time on the systems that I deal with. I can???t take total credit for that because technically this system belongs to another group and it???s their responsibility to handle things of this nature. In other words, it???s not my ???fat in the fire??? if something goes wrong ;-)

The one box that I have that is pretty much my own personal sandbox in this company has pretty much sank below radar and the password for it hasn???t changed in close to a year at this point.

Prior to it becoming a sandbox, it had a matching box in a different location. They were mirrored and had users on them on a regular basis. At that point, the root password would change each time that it got discovered by someone else, but on no regular basis other than that. This was a decision made by people above me.

Once they discovered that divulging the root password had caused them grief (they aren???t the most Unix-savvy people in this company) then they allowed me to take that part over and keep the password hidden from the general group. We haven???t had a system/software failure on them since.

The user passwords expire every 30 days and the users get to reset them. The department keeps a folder with these group passwords in them, but root isn???t included in there any longer.

Back to your specific questions:

How often..?
Rarely

Same or different????
Personally managed = same for like systems, otherwise different
Corporate = Trusted (who knows?)

Machine generated????
Not on my side, but I do use combo of all the elements that you mention.

Easy????
For me, of course! I don???t want to go ask someone what password I set. It???s embarrassing???

Dictated????
Officially, yes.
My systems (below corp. radar w/o sensitive company info) = Only by me.

Don???t know how long I can keep doing this my way, but so far it has worked out extremely well for us. The Borg haven't found me yet!!

Hope you find this interesting and/or helpful. If not, sorry to bother you.

[Paul Sperry]

We change our root password once a month.
We use a script that push out the same password
to every system on the network.

Usually our passwords come from sentences or
riddels. Like I'll be home for christmas
would be Ibh4xmas
or take me out to the ball game would be
tmo2tbG and so on

As you can see we include one upper case letter and one number, the upper case letter is determined by it's position in the alaphbet
and is at the beginning or end of the password.

In the 1st example i comes befor s so I gets
capitalized

In the 2nd example g comes before t so G gets
capitialized

password discipline dictated by our group
of sys admins.

[Brian M Rawlings]

Interesting thread.

For Clay: "Only boring astronomers find gratification knowing mnemonics" (not really, this is just the best one I've heard...)

John: this is what I recommend to clients, I have no production boxes of my own.

Root password on important machines, at least every 90 days, or if somebody leaves. Lab/test systems, once or twice a year, or if somebody leaves.

Common password for all production, common for all lab/test as well (different for each class). This means it must be impossible to devine or crack, but helps prevent it from getting written down anywhere.

Not random, something that can be remembered, but no 'themes', nothing that repeats from password to password. Generally a word that gets butchered to unrecognizibility, unrelated to previous password (similar to hacked/changed words or phrases others have suggested).

Who dictates or enforces the policy varies about 50/50 between admin staff or security/auditors/"from above".

Experience from a former life proved to me that an effort to "enhance" security through random-letter/number passwords that are force-changed once a month for everyone made for the least secure environment I've ever seen -- they were written down everywhere, generally in obvious "clever" places.

Come up with a good, uncrackable password, and why not use it widely for a limited time? The other important thing to enforce is not letting others watch you type it in (this has to become second nature).

Later... --bmr

[John Dvorchak]

1.We use different passwords for each system.
2.It is changed every 30 days by group policy.
3.Passwords contain letters, upper and lower case, punctuation and numbers.
4.We think of them ourselves.
5.Corporate policy encourages non trivial, alpha/numberic/punctuation, every 60 days.
6.Usually not easy to remember
7. /etc/securetty file so everyone has to su to root.
8.Everyone has their own history file so we can track what they do.

[Steven Sim Kok Leong]

Hi,

> How often do you change your root passwords?

Depends on the criticality of the server and sensitivity of data stored on the server. On average, 60 days.

> Do you keep a different root password for each Unix machine or do you use the same one for multiple machines?

Different ones.

> Do you use a machine generated password with lots of upper and lower case letters, numbers, and special characters?

No.

> Do you use something that is somewhat easy to remember or are they completely random?

Easy to remember yet difficult to guess.

Is your password discipline dictated by company/departmental policy or is it determined by you and your group?

Dictated by our Corporate IT security policies.

A good choice of passwords would be to use the beginning letter of every word in an easy to remember phrase. For instance,

The phrase:

I love to use this excellent forum for answers

translates to:

Il2uteffa

Hope this helps. Regards.

Steven Sim Kok Leong

[Andi Rigauer]

Hi Out there,

some thing to consider is that in when you do a telnet to a unix system the passwd will not be encrypted that means every secretary with an ip sniffer and a small knowledge can get the unix passwords also the root one.
Before you think of all the things like passwd expiration and so on which is nice to have you should protect the passwd in the lan for instance use the ssh. BRGDS
Andi soory for the bad english.
But I'm from old europe :)