0
votes
1answer
20 views

Nginx Password Protect Directory Downloads Source Code

I'm trying to password protect a WordPress login page on my Nginx server. When I navigate to http://www.example.com/wp-login.php, this brings up the "Authentication Required" prompt (not the WordPress ...
2
votes
1answer
44 views

The ipmitool conundrum

We have been trying to migrate to a better password management system on our server. The problem was that all this days we were using a proprietary algorithm to create a hash (a decryptable hash). In ...
2
votes
2answers
55 views

Configuring sudo to not prompt for password on non-allowed commands

There is plenty of information on how to make sudo not prompt for passwords (NOPASSWD). Let's say I have user alice, and this line in my sudoers: alice ALL=(root) NOPASSWD: /bin/myadmintool This ...
3
votes
1answer
138 views

How to deal with passwords during automated deployment? [closed]

As responsible admins we know of common weaknesses like CWE-260: Password in Configuration File http://cwe.mitre.org/data/definitions/260.html CWE-522: Insufficiently Protected Credentials ...
22
votes
8answers
4k views

How to hide a password passed as command line argument?

I'm running a software daemon that requires for certain actions to enter a passphrase to unlock some features which looks for example like that: $ darkcoind masternode start <mypassphrase> ...
-1
votes
2answers
57 views

Security in users having sudo access

How to protect my passwords list (in different databases for example) in a UNIX environment where most of the users have sudo access to other user IDs? I have a script (main.sh) with the following ...
1
vote
0answers
46 views

What are the mathematical implications of an overly-restrictive password policy? [closed]

I came across an interesting password policy online recently: "Please be sure to enter a password that meets the following criteria: must be 8 characters long must not be based on dictionary words ...
40
votes
6answers
3k views

Is it OK to set up passwordless `sudo` on a cloud server?

Sorry if the question is vague but I don't know a better way to ask and I didn't see the caveats/tradeoffs of the approach discussed here. I love the idea of accessing servers via keys, so that I ...
0
votes
2answers
2k views

Allow linux root user mysql root access without password

On cPanel when I am logged in as root and type "mysql" without hostname and password it gives me direct access to mysql root user. I would like to do this for one of my non-cpanel server where the ...
4
votes
1answer
104 views

Safely providing passwords to a linux daemon

I have a linux daemon that accesses some services (db etc). It needs some passwords for this. What would be the best way to give the passwords to the daemon in a secure manner? I currently store the ...
3
votes
4answers
110 views

Our server hosting provider asked for our root password

I work at a company that develops and hosts a small business critical system. We have an "Elastic cloud server" from a professional hosting provider. I recently got an email from them saying that ...
1
vote
2answers
55 views

Should I change root password

I manage about 50 servers mostly by remote access using ssh on a custom port (root login disabled and users need a public/private key to log in, password login are disabled). each servers have a ...
2
votes
2answers
1k views

Configure Ubuntu to allow ssh login via pulic/private key and sudo without password

I'm setting up a fresh Ubuntu 13.04 server. I created some users and copied their public keys for ssh authentication to their home folders. Login via password will be disabled. Everything works fine ...
30
votes
7answers
2k views

What would you do if you realized your email hosting provider could see your passwords?

We received an email last year from our hosting provider regarding one of our accounts- it had been compromised and used to deliver a rather generous helping of spam. Apparently, the user had reset ...
-5
votes
1answer
242 views

How to use Puppet to synchronize user passwords across servers? [closed]

I've been assigned to use Puppet to synchronize user passwords across an arbitrary number of servers, so that a user can change their password once and have that change pushed out to an arbitrary ...
2
votes
2answers
86 views

Are passwords sent via a bash script retrievable?

As part of running a backup script for a linux server, I have commands like mysqldump within a bash script which contain the mysql root password, and certain ftp server passwords. Are these ...
4
votes
3answers
2k views

What is the rationale for a minimum password age?

I just had a user unable to change his password on a Windows 2008 domain. It was giving him a cryptic message about complexity requirements even though he was certain his chosen password was meeting ...
1
vote
1answer
78 views

sudo passwd on Ubuntu 11.10 strange behavior. Have I been rooted?

I'm in a really strange situation. A few hours ago Rackspace issued a ticket saying there's a outbound flood originating from my server. Thinking the server might have been rooted with a rootkit I ...
1
vote
1answer
45 views

Password require pre- and suffix

Is is possible to configure a required pre- and suffix that users need to use while changing their password in a Microsoft environment? If so how? Let me explain where this comes from. In my company ...
2
votes
1answer
101 views

How to set up sshd so that it never asks for a password for a specific user?

I have a dedicated system account named "git" that is managed by gitlab/gitolite. Users connecting to this account always use SSH keys, "git" user doesn't have a password. If users connect without a ...
7
votes
2answers
463 views

Password similarity

I wanted to change my password on a unix machine. I did a normal "passwd" and typed in my old and my new password. Then the machine came back to me with the following message: BAD PASSWORD: is too ...
4
votes
3answers
186 views

Store system passwords with easy and secure access

I'm having to handle several VPS/services and I always set passwords to be different and random. What kind of storage do you suggest to keep these passwords safe and let me access them easily? ...
-1
votes
1answer
104 views

Linux: limits on password length

I remember a time when Unix passwords (or was it usernames) could be no longer than 8 or 16 characters. Even nowadays, the password box displayed by login managers is relatively narrow, although one ...
-1
votes
3answers
208 views

How to Set Multiple Passwords for “HIgh Profile” Accounts

I generally set up servers with "important" services listening on nonstandard ports (e.g. SSH != 22) and rename or completely remove root/admin users. I recently thought that it might be fun to create ...
2
votes
1answer
98 views

extract iis saved password

In IIS6 settings for a domain, under the Directory Securty » Authentication and access control » Enable anonymous access, there's typically a user name and password supplied specifying the ...
1
vote
3answers
203 views

Your thoughts on managing passwords in a corporate server environment

Good evening, I'm thinking about implementing some way to manage passwords for our Linux/Windows servers based solely on security concerns and an ever growing number of servers. How do you do it? ...
6
votes
3answers
2k views

Managing service passwords with Puppet

I'm setting up my Bacula configuration in Puppet. One thing I want to do is ensure that each password field is different. My current thought is to hash the hostname with a secret value that would ...
2
votes
2answers
5k views

How does the Task Scheduler save passwords on Windows 7?

If I save a password for a scheduled task, or in a service's logon credentials, is it safe? It seems to me that Windows saves this password encrypted somehow, but since Windows has to decipher it, so ...
1
vote
1answer
702 views

How to safely store proxy passwords in system-wide linux config files?

I'm working on a VM in a university environment, where several other users also have root access. Take a config file like /etc/rhsm/rhsm.conf: proxy_hostname = proxy_port = proxy_user = ...
1
vote
1answer
228 views

Why warn users weeks before their passwords expire? [closed]

At my workplace (and I am told many others), several password-requiring systems warn users every day during the two week period before their passwords expire. The warning consists of a dialog box that ...
5
votes
2answers
7k views

Users can't change password trough OWA for Exchange 2010

Here's our problem, users who want to change their password trough OWA get this error "The password you entered doesn't meet the minimum security requirements.", even if users are respecting the ...
2
votes
2answers
559 views

Software to brute force MD5 password on multi-core machine? [closed]

First off, I'm well aware that this is a controversial topic. I can give my word as a sysadmin that I have the best of intentions (depending on how you view the next paragraph) but I understand that ...
0
votes
2answers
221 views

force use of specific passwords

We are migrating Active Directory from from Windows Server 2003 to 2008 shortly. With 2008 we would like to be able to use a separate password policy for a particular group of PCs. One suggested ...
0
votes
2answers
106 views

ssh - keys and password

I've gotten keys (certificates) working correctly, but as it is, it's more of a "convenience" thing. (which I love). But as far as security, someone can still use a password to login. What's a good ...
1
vote
1answer
452 views

Linux password complexity settings

I have two questions about the system-auth file 1) If the /etc/pam.d/system-auth password complexity settings are changed on an existing system, does it invalidate any existing passwords? 2) Is it ...
3
votes
4answers
374 views

Web server minimum password security based on 100 attempts per second

This insightful article proposes that passwords don't need to be very secure: http://www.baekdal.com/tips/password-security-usability? There is one specific line in here that I find troubling: ...
5
votes
3answers
858 views

Why do some websites prevent you from using non-alphanumeric characters in your site password? [closed]

I logged in to a website today and found this message: As a part of new security systems upgrades, we are requiring all existing customers to change their password to enhance the protection of ...
1
vote
2answers
215 views

Passwords no longer work after changing security settings

I've been trying to configure my server for security, but I have no idea what I'm doing. I'm following various guides to the best of my ability - one of them being the following: ...
1
vote
1answer
513 views

Git through https

When I clone a repo with git clone https://username@domain.com/directory or when I push to it with git push origin master Git asks me for a password, how I can automatically provide the ...
2
votes
2answers
164 views

How to manually start and re-start Apache with mod_wsgi powering a password protected Python WSGI app?

I'm working on a project where I have to meet some regulatory requirements that require at least 3 out of 5 authorized users to start a backend web service that handles very sensitive information ...
1
vote
2answers
192 views

How to create a password-less service account in AD?

Is it possible to create domain accounts that can only be accessed via a domain administrator or similar access? The goal is to create domain users that have certain network access based on their ...
0
votes
4answers
367 views

Safety concerns on allowing connections to MySQL with no password on localhost?

In the case of a Linux system, is there any security concern to let MySQL users with standard privileges (that is, not the root users) connect to the database with no password from localhost? I think ...
19
votes
16answers
1k views

Why is it bad to have a weak mysql user password?

I was presented with an argument to the tune of "you don't need a strong mysql user password because in order to use it, they'd already have access to your server." We're talking about a 4 digit ...
0
votes
1answer
447 views

PAM cracklib vs login.defs

If there are different parameters set for minimum password length in pam_cracklib and login.defs. Which takes precedence ? Any good docs/books about PAM ?
0
votes
1answer
447 views

problem of Configure linux password rules: password shouldn't be the reverse of previous password

I am configuring password rules in linux system(RedHat Enterprise linux 5). By google, I found that using pam_cracklib will make simple check automatically. That is, pam_cracklib will automatically ...
2
votes
3answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over ...
3
votes
3answers
416 views

Windows XP Allows Account with Blank Password

I have the local security policy set to require a minimum password length of 10 characters. On a computer that is not part of a domain, and using the local admin account: Scenario 1: If a user is ...
1
vote
1answer
1k views

Disable password age policy for admin on Windows Server

By default on my SBS08, the Maximum password age is set to 1year. I'd like to disable this particular parameter for Domain Admin, not the entire policy (Default Domain Policy). Is that possible ? ...
1
vote
5answers
2k views

How can I use fetchmail (or another email grabber) with OSX keychain for authentication?

Many fetchmail tutorials I've read says putting your email account password clear-text in a config file is safe. However, I prefer security through layers [silly example: if my terminal is up and ...
1
vote
3answers
2k views

In Windows XP, is it possible to disable user credential caching for particular users

I understand that when windows caches user credentials, these can sometimes be used by malicious parties to access other machines once a machine containing cached credentials is compromised, a method ...