A password is a collection of characters that is used, usually in conjunction with a username, as a means of authentication.

learn more… | top users | synonyms (1)

118
votes
4answers
4k views

Is my password compromised because I forgot to hit Enter after ssh username?

I've just tried logging into a Fedora (release 13 Goddard) server using SSH (PuTTY, Windows). For some reason the Enter after typing my username didn't go through and I typed in my password and hit ...
50
votes
9answers
11k views

Company Password Management [closed]

The topic of personal password management has been covered in great detail time after time. This question is aimed at the business or organization that needs to keep track of many unique passwords for ...
49
votes
3answers
34k views

how to disable SSH login with password for some users?

On Linux (Debian Squeeze) I would like to disable SSH login using password to some users (selected group or all users except root). But I do not want to disable login using certificate for them. ...
48
votes
19answers
6k views

Best Practise and Solutions for Sharing Passwords

We have various passwords that need to be known to more than one person in our company. For example, the admin password to our internet routers, the password for our web-host, and also a few "non-IT" ...
47
votes
8answers
104k views

How to automate SSH login with password?

How to automate SSH login with password? I'm configuring my test VM, so heavy security is not considered. SSH chosen for acceptable security with minimal configuration. ex) echo password | ssh ...
43
votes
40answers
4k views

How do you manage your passwords?

Obviously seeing as how many of us here are system administrator type people, we have a lot of passwords strung out across numerous systems and accounts. Some of them are low priority, others could ...
39
votes
6answers
3k views

Is it OK to set up passwordless `sudo` on a cloud server?

Sorry if the question is vague but I don't know a better way to ask and I didn't see the caveats/tradeoffs of the approach discussed here. I love the idea of accessing servers via keys, so that I ...
30
votes
7answers
2k views

What would you do if you realized your email hosting provider could see your passwords?

We received an email last year from our hosting provider regarding one of our accounts- it had been compromised and used to deliver a rather generous helping of spam. Apparently, the user had reset ...
27
votes
22answers
2k views

Password best practices

Given the recent events with a 'hacker' learning and retrying passwords from website administrators, what can we suggest to everyone about best practices when it comes to passwords? use unique ...
25
votes
9answers
2k views

Is packet sniffing for passwords on a fully switched network really a concern?

I administer a number of linux servers that require telnet access for users. Currently the user's credentials are stored locally on each server and the passwords tend to be very weak and there is no ...
23
votes
4answers
25k views

How to setup passwordless `sudo` on Linux?

How can passwordless sudo access be setup on either RHEL (Fedora, CentOS, etc) or Ubuntu distributions? (If it's the same across distros, that's even better!) Setting: personal and/or lab/training ...
19
votes
16answers
1k views

Why is it bad to have a weak mysql user password?

I was presented with an argument to the tune of "you don't need a strong mysql user password because in order to use it, they'd already have access to your server." We're talking about a 4 digit ...
18
votes
14answers
2k views

Should I force my users to change passwords every n days/weeks/month?

Question says it all. We are designing a system where security is very important. One of the ideas someone had was to force users to change passwords every 3 months. My take on this is that while its ...
18
votes
1answer
1k views

Why are md5 passwords hashed differently?

I've been wondering for a while, why does running "echo 'helloworld' | openssl passwd -1 -stdin" yield different results every time?If I put any of the hashes in my /etc/shadow I can use them as my ...
17
votes
9answers
1k views

User password age/complexity policy

Has anyone got any resources for determining a reasonable password policy for my users? My personal leaning is to ratchet up password complexity and allow them to change them less often as a kind of ...
17
votes
10answers
3k views

Password Manager that allows syncing accross platforms

I use OS X, Linux, Solaris and windows for work and from home. There are good tools that allow me to manage the many logins/passwords required platform independently. But mostly they expect me to ...
16
votes
7answers
73k views

Disable password complexity rule in Active Directory

Where do I go to disable the password complexity policy for the domain? I've logged onto the domain controller (Windows Server 2008) and found the option in local policies which is of course locked ...
15
votes
6answers
118k views

How to pass password to scp command used in bash script? [duplicate]

Possible Duplicate: Connect through SSH and type in password automatically, without using a public key I have a bash script that makes dump of DB then copies file from one server to another ...
15
votes
3answers
9k views

How secure is a bluetooth keyboard against password sniffing?

In a situation where an admin will enter sensitive information into a keyboard (the root password), what is the risk that a bluetooth keyboard (ship by default with Mac systems these days) would put ...
15
votes
9answers
8k views

Password Management System for multiple SysAdmins?

I'm interested in best practices and potential open source projects that would allow my organization to securely store multiple passwords and allow multiple administrators to access them. I'm ...
14
votes
4answers
10k views

ssh: “Agent admitted failure to sign using the key”

I'm trying to set up password-less login with ssh on Ubuntu Server, but I keep getting: Agent admitted failure to sign using the key and prompt for password. I have generated new rsa keys. Before ...
14
votes
11answers
4k views

Is there a security benefit to a regular changing password policy?

I've found in several cases, forcing users to change their password on a regular basis becomes more of a strain on maintenance rather than a help for security. Also, I've seen users write their new ...
14
votes
2answers
1k views

Wget: Is there a way to pass username and password from a file?

Is there a way to pass the username and password from a file instead of the command line via --user and --password? Background: I want to run wget via cron and don't want the username/password show ...
13
votes
11answers
801 views

Is there a standard method of proving password security to non-mathematicians?

My client has a server that is being subjected to brute-force login attempts from a botnet. Due to the vagaries of the server and the client's client, we can't easily block the attempts through a ...
12
votes
13answers
3k views

Password expiration policies [closed]

Having just received an email from a supplier informing us that they would be forcing us to change our password every six months, I'm curious to see what password expiration policies people use and ...
12
votes
10answers
826 views

What is the best way to gain access when the password is unknown?

If you were provided a computer running Windows 2000 or newer and you have no passwords, what method do you use to gain access with administrator privileges so you can use the system?
12
votes
5answers
3k views

How often do you change your administrator/root password?

I have a bad habit of rarely changing the administrator password in my domain. The passwords I do use are pretty good but I want to be more consistent on this. What do you think is a good frequency? ...
11
votes
12answers
4k views

what's a secure way to send passwords over the internet?

I'm looking for the best way to send passwords over the internet safely. Options I've looked at are PGP and encrypted RAR files. There are no real parameters other than getting from point a to point ...
11
votes
15answers
2k views

What's the safest online password system?

It's so difficult to track dozens of passwords in different locations. Syncing fails from time to time and you end up with collision correction avoidance syndrome. Is there a single source of safe, ...
11
votes
10answers
4k views

Best way to go about changing a root password on 3000+ Solaris, AIX, and Linux servers?

Long story short: Big old corporation, lots of UNIX/Linux servers. I inherited responsibility for a bunch of scripts that that left a few years ago. One of them was a script that would be run every ...
11
votes
4answers
7k views

outlook requiring password after exchange reboot

We recently moved from Exchange 2003 to 2010, and have noticed a quirk that is annoying us. If our exchange server (single server) goes down, ie it gets rebooted, or client loses connectivity (or for ...
10
votes
17answers
1k views

What are the arguments for and against a network policy where the sys admin knows users passwords?

I'd like to know pros and cons.. reasons for and against the idea of sys admin’s maintaining user account lists with passwords.. and additionally not allowing those users to change their passwords. I ...
10
votes
7answers
1k views

is it okay to use random URLs instead of passwords? [closed]

Is it considered "safe" to use URL constructed from random characters like this? http://example.com/EU3uc654/Photos I'd like to put some files/picture galleries on a webserver that are only to be ...
10
votes
3answers
2k views

How to reset or recover admin account password for MySql?

I have a MySql database that I "inherited" and I was not given the admin credentials. I do however have access to the box that it runs on. Is there a way to either recover the admin credentials or ...
10
votes
1answer
848 views

Workaround for when windows scheduled tasks fails when user changes their password

When a users password changes that users scheduled tasks will fail unless you change the password associated with that task. This is a problem for me as I have a small script that gets run by a ...
10
votes
7answers
2k views

Storing rarely used single-purpose passwords

How do you handle the storage of passwords that, by nature of their usage, you can't expect administrators to memorize? Such as: Administrator/root password when everyone logs on using their own ...
10
votes
7answers
24k views

Web interface to allow users to change their Active Directory password

I have a few web applications that use Active Directory to authenticate. What I would like to be able to do is provide a simple web page that would allow users to update their AD password. This ...
10
votes
4answers
10k views

Check if user password input is valid in Powershell script

I am working with a Powershell script that adds scheduled tasks to systems in our domain. When I run this script, it will prompt me for my password. I sometimes fat finger the password and the process ...
9
votes
4answers
3k views

Unlock Windows AD account & assign *temporary* password via command line?

Joe Brown is on the phone. He is locked out of Windows because he has forgotten his password. We could reset his password via Active Directory Users and Computers, but ADUC is very annoyingly ...
9
votes
4answers
3k views

How to manage a web servers SSL private key protection (password vs. no password)?

We have a discussion in my company's security group about what's the worse of the following options to manage SSL private key. The web server needs access to the private key for the encryption ...
9
votes
3answers
4k views

How do I setup sshd on Mac OS X to only allow key-based authentication?

I have a Mac OS X machine (Mac mini running 10.5) with Remote Login enabled. I want to open the sshd port to the Internet to be able to login remotely. For security reasons I want to disable remote ...
9
votes
2answers
1k views

What's the best solution to manage root password of thousands servers

I'm a system administrator. In the production environment I need to manage thousands of servers. My colleagues and I uses a central manage server and distribute its public key through other servers. ...
8
votes
4answers
117k views

What's the default username and password for an Ubuntu Live CD?

What's the username and password for an Ubuntu Live CD image? I ask cause I've recently copied the contents of an Ubuntu based live ISO (easypeasy, the ldistro for nwtbooks) onto a harddisk, but the ...
8
votes
6answers
16k views

Tool to test a user account and password (test login)

Yeah, I can fire up a VM or remote into something and try the password...I know...but is there a tool or script that will simulate a login just enough to confirm or deny that the password is correct? ...
8
votes
4answers
774 views

Encrypt temporary password using public ssh key

I manage a virtual office and our staff uses both SSH keys and passwords for authentication. If one of our staff forgets his password, is there a way to encrypt a temporary password using his public ...
8
votes
7answers
4k views

How do I keep the local admin password consistent across an OU?

We have a number of PCs running XP SP2 (and a couple running SP1) already in production, and we're looking to keep the local administrator's password consistent across the OU. The only solutions I can ...
8
votes
4answers
7k views

Is there a group policy that would push a new user name and password to all local machines on a network?

I work on a small network that runs on windows server 2003, and with machines running xp. Is there a group policy that could push a new user name and password to replace our old local administrator ...
8
votes
5answers
782 views

Web Based (and Encrypted) Password/License/Etc Database

Looking for a system to store the many credentials I use as a consultant/contract programmer. While I know I could use KeePass or similar for desktop use, or something like PassPack for web based ...
7
votes
9answers
4k views

How secure are passwords with under 20 characters length?

I recently received a recommandation for setting my password to above 20 characters. The algorithm used for encryption is AES with a 256 bit primary key. How secure is a, let's say, 8 char password ...
7
votes
3answers
462 views

Reset Windows user domain password

Is there a way to reset a user domain password remotely without login to a remote desktop to the domain controller? I could not find any MMC plugin in non-server Windows (Window 7 Ultimate in this ...