Re: sync root passwords?

[Andrew Perrin <clists@perrin.socsci.unc.edu>]

No, it's not more insecure; you're assuming the hypothetical hacker knows
that there is an algorithm, and which character(s) are filled in by it.  

Take the canonical, one-password case, and give me a reasonably good
password, say one generated from the phrase "I Procrastinate On Grading
Papers By Debating Debian!":

I!engsygN

(whoever finds the phrase->password algorithm can stay after class to
clean the erasers)

With 100 machines, the hypothetical hacker has all of them if s/he gets
one of them.

Now, make an (unpublicized) decision to replace the I with the capitalized
last two letters of each hostname:

my @hosts='washington jefferson adams franklin';
for (@hosts) {
	my $pass = uc(substr($_, -2, 2)) . '!engsygN';
}

And, of course, delete the generator script when you're done.  Now the
hypothetical hacker finds the root password to one, but remains locked out
of all the others.

Of course this is "worse" than random separate passwords for each machine,
but my view is that with 100 machines the risk is far greater that someone
writes down the passwords and leaves them in a public place.  But it's
hard to see how this is worse than 100 with the same root password.

ap

----------------------------------------------------------------------
Andrew J Perrin - http://www.unc.edu/~aperrin
Assistant Professor of Sociology, U of North Carolina, Chapel Hill
clists@perrin.socsci.unc.edu * andrew_perrin (at) unc.edu


On Wed, 4 Dec 2002, sean finney wrote:

> On Wed, Dec 04, 2002 at 04:57:27PM -0500, Andrew Perrin wrote:
> > You might want to reconsider the project, frankly - why not make different
> > root passwords for different machines? That would seem to be a more secure
> > alternative. You can make them systematically different to save yourself
> > memorizing them all, by (for example) using the second letter of the
> > hostname as one of the characters of the root password or something along
> > those lines.
> 
> that's way more insecure, as the hypothetical hacker could then know
> (or more easily guess) what one of the characters in the password is!  
> 
> 
> 	sean
>