Date: Wed, 05 Feb 2014 20:16:21 -0500 From: Allan Jude <freebsd@allanjude.com> To: freebsd-doc@freebsd.org Subject: Re: Patch (WIP): New security front matter; new shell redirection section Message-ID: <52F2E265.3050602@allanjude.com> In-Reply-To: <20140204075336.3e6291f2.trhodes@FreeBSD.org> References: <20140202175121.16a0c264.trhodes@FreeBSD.org> <201402040800.s1480fXU006990@chilled.skew.org> <20140204075336.3e6291f2.trhodes@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --MggfRIBWbATnLD7UFvWtCoqtjO3OnGiHE Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable On 2014-02-04 07:53, Tom Rhodes wrote: > On Tue, 4 Feb 2014 01:00:41 -0700 (MST) > Mike Brown <mike@skew.org> wrote: >=20 >> Tom Rhodes wrote: >>> + <para>Passwords are a necessary evil of the past. In the case= s >>> + they must be used, not only should the password be extremely >>> + complex, but also use a powerful hash mechanism to protect it. >>> + At the time of this writing, &os; supports >>> + <acronym>DES</acronym>, <acronym>MD</acronym>5, Blowfish, >>> + <acronym>SHA</acronym>256, and <acronym>SHA</acronym>512 in >>> + the <function>crypt()</function> library. The default is >>> + <acronym>SHA</acronym>512 and should not be changed backwards; >>> + however, some users like to use the Blowfish option. Each >>> + mechanism, aside from <acronym>DES</acronym>, has a unique >>> + beginning to designate the hash mechanism assigned. For the >>> + <acronym>MD</acronym>5 mechanism, the symbol is a >>> + <quote>$</quote> sign. For the <acronym>SHA</acronym>256 or >>> + <acronym>SHA</acronym>512, the symbol is <quote>$6$</quote> >>> + and Blowfish uses <quote>$2a$</quote>. Any weaker passwords >>> + should be re-hashed by asking the user to run &man.passwd.1; >>> + during their next login.</para> >> >> I get confused by this. >> >> "Any weaker passwords" immediately follows discussion of hash >> mechanisms, suggesting you actually mean to say "Any passwords >> protected by weaker hash mechanisms" ... although maybe you >> were done talking about hash mechanisms and were actually now >> back to talking about password complexity? Please clarify. >> >> Either way, how do I inspect /etc/spwd.db to find out who has=20 >> weak/not-complex-enough passwords, and what hash mechanism is in use >> for each user, so I know who needs to run passwd(1)? >> >> If this info is already in the chapter, forgive me; I am just >> going by what's in the diff. >> >> Anyway, overall it looks great. >=20 > Thanks! >=20 > You actually did remind me that, with the new version I > just put in, I added a bunch of sections but completely > dropped the ball on checking for weak passwords! >=20 > Though, the new chapter has sudo, rkhunter, and setting > up an mtree(8) based IDS and more tunables. I'll try > to work up an additional bit of cracking passwords and > the like sometime this week. Cheers, >=20 It may be worth noting that bcrypt (the blowfish based hashing algorithm) is not the same thing as blowfish the symmetric encryption system. It might just be best to call it bcrypt instead of blowfish. You might also mention the 'freebsd-update IDS' feature, which compares the SHA256 hashes of the base files against the know good values for a system upgraded with freebsd-update. --=20 Allan Jude --MggfRIBWbATnLD7UFvWtCoqtjO3OnGiHE Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJS8uJxAAoJEJrBFpNRJZKfHD4P/2xi3jQAK+dyFFhjb6Ciqt2W AuZJryruD3OoPdQcJAkVjlJvFzzJxpyUGfc0cczJQN18pPa9bXRLRFnH01NgJkXn xzfJ28N9BVRK0Fs69zzF4SgCAj3dkjNHzV7N135gNUE9nmiXh0sqk8XMSkcvEcKN x+M/hQkCVRppf+DHcUckCPTEzKQGTeg3XlPJbSiaiK0l6qZpnjo1ZcF3d/6oqH4P eFAyBCAglJi1QS4zwpfmhNVLhMy18IFhtW+ajtw2+/hZXZSbtMoaadMHn49+Antq rI0G/V4ZWKOCasXejeZZQrqTrcAuDSssd0/HmMikLMPFl8MqVyhwlUO5F75/nuXS JcXnK9QZIlHvUW/0b6xdJcr/Fw6rWlPWhAlGT8jJA6xFQaFIu5A64iOSCOyUa0wM gRHjfYPUxz6jgqUtLdE2BgFzFCHXaib2/6ugJLUrAjR2OMR3Erjovaq2vuRu20hZ G6mdRXFHocD+fDHFHxahdOMzy8BUmdIWOP+utaNktKOxt8cm/ekUD8Rac0lagZZV 3htzaS0G4FoUJoZhqMyRK4N3s28UqtWXMAcRRIpdvI2/zLMAiCk4PGjZkjK5Y7Wg 0PjHtXSPhzMteV8FL7D8wyeM3agblG9Wq6hjlIV41FqNlDOyRtj9f3tR3omCV703 0U9CM1muwY9tIy8lOxpf =8nGp -----END PGP SIGNATURE----- --MggfRIBWbATnLD7UFvWtCoqtjO3OnGiHE--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?52F2E265.3050602>