1. CIS 450 – Network Security Chapter 10 – UNIX Password Crackers

2. Easiest way to identify weak passwords in a UNIX environment is to utilize UNIX password cracker tools Where are Passwords stored in UNIX? Non-sensitive information in /etc/passwd, which is world readable The hashed passwords stored in /etc/shadow with only those with root access can read the shadow file

3. How Does UNIX Encrypt Passwords Uses an encryption algorithm called Crypt to encrypt its passwords http://fooassociates.com/phpfer/html/rn58re1161.ht ml http://fooassociates.com/phpfer/html/rn58re1161.ht ml Uses DES, Blowfish, and MD5 algorithmsDES BlowfishMD5

4. UNIX Password Cracking Programs Master List http://neworder.box.sk/box.php3?gfx=neworder&prj=neword er&key=passhack&txt=Unix%20password%20crackers http://neworder.box.sk/box.php3?gfx=neworder&prj=neword er&key=passhack&txt=Unix%20password%20crackers Crack http://www.crypticide.com/users/alecm/security/c50a.txt John the Ripper http://www.openwall.com/john/ XIT http://neworder.box.sk/codebox.search.php?srch=xit Slurpie Similar to John The Ripper and Crack except it is designed to run on multiple computers simultaneously, creating a distributed password cracking attack. http://www.ussrback.com/distributed.htm

5. Protecting Against UNIX Password Crackers Have a strong password policy – pages 377 - 378 Use shadow files – page 378 Use one-time passwords – passwords change every time use logs on – page 379 Use biometric authentication – authenticates a user based on human factors – page 380 Use UNIX Password Programs to enforce strong passwords General information – page 380 http://www.foobargeek.com/docs/epasswd.html Passwd+ http://www.securityfocus.com/tools/1065 Npasswd http://www.utexas.edu/cc/unix/software/npasswd/doc/ Epasswd http://www.nas.nasa.gov/Groups/Security/epasswd/

6. Protecting Against UNIX Password Crackers Audit access to key files – normally only way to detect the attack is to catch them when the password or shadow file is being accessed - page 381 Scan for cracking tools – page 381 Keep inventory of active accounts – company should have a policy for checking active accounts & removing accounts that are no longer active – page 381 Limit who has access to root – page 382