Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hosting provider M6.net explained me that the password security of its control panel (Plesk) is limited to a maximum of 14 characters. This article on Parallels explaining backs him up. However, he claims that this restriction applies to any password set through Plesk, including DB passwords. Is this correct?

In a world of ever increasing online threads, I tend to simply back away, not trusting the system that doesn't allow or enforce strong passwords. I find it very odd that a reputable company like Parallels limit security this way.

Should I change my vision? More importantly, what control panels, if any (cpanel?) allow arbitrary length passwords without restrictions on the characters?

(Note: this is a bit of a follow up to this more general question)

share|improve this question
2  
I've had such a horrible experience with M6 that I no longer believe anything they say... –  squillman Nov 13 '09 at 3:31

2 Answers 2

This likely comes down to the usefulness of said longer passwords. It may be that the password hashing algorithm is only based on the first 14 digits of the string entered, or that it can cause hash collisions if more than 14 characters are present.

It is a current well-known standard that passwords 12 characters in length are essentially unable to be brute forced, especially if they use a mixture of numbers, letters and symbols. Anything beyond that length and you're just making your life more difficult.

share|improve this answer
1  
Or: beyond that length, you can use passphrase style passwords which are more easily remembered. I may be paranoia, but what currently takes 3 years to crack, can take 3 days to crack tomorrow. The hash thing is interesting, but this is about MSSQL DB passwords which are hashed for 127 characters iirc. And for what it's worth, shouldn't we simply be able to use our own judgment and choose what lengths fits us, or the tools we're using, best? –  Abel Nov 6 '09 at 23:45
up vote 1 down vote accepted

Plesk has taken the wrong path by limiting the length of the passwords and not making this either configurable or substantially longer. It's odd that even the system user or administrator cannot have a stronger or longer password.

While it can be argued that 14 characters is long enough, it doesn't allow for (semi) arbitrary length passwords, or easy to remember but lengthy and strong passwords.

A control panel system that takes this to another extreme, cPanel, aids the user in choosing a strong-enough password and makes its presets configurable on a scale from 0 - 100 (100 being extremely strong). This helps both the user (who gets information about strength) and the administrator (who can limit access to users that have sufficiently strong passwords, or allow very weak passwords, depending on application domain). More info here.

Other control panels have either other restrictions, or no restrictions at all, or make it configurable just like cPanel.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.