Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Does anyone have an opinion on using UUIDs as passwords? This is intended for accounts created for external users, such as customer access to private SFTP folders. Or are people using public key instead? These users don't have a shell and are chroot'd to their directory.

From the manpage:

UUIDs are 128 bit numbers which are intended to have a high likelihood of uniqueness over space and time and are computationally difficult to guess. They are globally unique identifiers which can be locally generated without contacting a global registration authority. UUIDs are intended as unique identifiers for both mass tagging objects with an extremely short lifetime and to reliably identifying very persistent objects across a network.

I'm on Ubuntu 9.10, but the OSSP uuid package is available for most *nix distributions.

share|improve this question

2 Answers 2

There are many ways to generate a UUID, some of which are likely highly guessable. For instance, the current time is often a component and sitting right there, as is the machine's MAC address, etc. Don't confuse unique with unguessable.

I would not try to re-purpose UUIDs for passwords, but instead choose a strong password generator. If you're thinking about using a UUID for a password, clearly being able to remember it is not important, so I'd choose something like the output of MD5 with a few bytes from /dev/random or /dev/urandom:

dd if=/dev/random bs=128 count=1 | md5

Or, better yet, use a tool designed specifically for generating strong passwords. Ideally ones that users can remember without writing them down.

share|improve this answer
    
Yes, in the past I've used apg(1) to generate passwords, which isn't bad. What's happening here is that users are using WinSCP, and saving the password in their profile. The risk of someone else using their account is limited to them being able to read that customers' reports - the shell is /bin/false, and I'm using the new chroot capabilities of OpenSSH. So memorability isn't really a concern. –  Andrew H Dec 16 '09 at 12:08

The higher the level of complexity in the password the higher the chance that the user will write it down on a post it note and stick it to their monitor, that is in addition the the support costs when the user forgets the password.

When using SSH Keys some form of password is recommended (but not required) to secure the key. Pass phrases are easier to remember than passwords so something like:

  • Firefox&is&JUST&a&browser
  • NotTheFirstHackI'dTry
  • The Quick Brown Fox

Will both reduce the incidence of calls to reset forgotten passwords, and improve security because your users are going to be able to remember them without writing them down.

share|improve this answer
    
It should be noted that passwords are not strictly required to secure SSH keys, they're completely optional. –  pboin Dec 16 '09 at 11:14
    
Updated, not using a password significantly reduces the security of the system, whilst technically it may not be required I would be surprised if company policy didn't require it. –  Richard Slater Dec 16 '09 at 11:26
    
Yea, but in his case he knows people are storing the passwords in their profile, so an unprotected SSH key is only slightly worse than storing the key in the registry or some other file. –  Michael Graff Dec 17 '09 at 20:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.