Whilst I share some of the concerns of other correspondents, I also note an argument of pragmatism.
I have to issue a lot of passwords to people in other countries. I don't know them; I have no means of contacting them face-to-face; I can't engage a courier to hand-deliver a password each time; and the delays of postal mail (which also is by no means a guaranteed person-to-person service) are considered business-unacceptable.
So what's a sysadmin to do? I have to get passwords to people somehow, or noone will ever be able to log in.
So for some time I've done as you do. I require a GSM phone number for each validated new password (or change) request, and I SMS the password to that number; username, system addresses etc. all go through email from the ticketing system they've used to log the request. The only wrinkle I've added is to pre-expire the password, which requires it to be changed on first login. On Linux, I do this with chage -d 0 username
after setting the password, and on Solaris with passwd -f username
.
This means that the token isn't infinitely reusable if it's disclosed; a black hat coming across the discarded text message will only know what the password used to be. It also means that if someone else gets it first, I'll find out about it, because the legitimate user won't be able to log in after the black hat has got there and changed it first.
It's still not perfect, and there are still ways it can fail, but I have yet to find anything better. Anyone?