Linux Password Commands And Tips For Creating a Secure Password
How to Change User Passwords In Linux
To change a password for a specific user other than root, Login to the "root" account or “su” to the root account. Then type, `passwd user` (“user” is the username for the account you are changing the password). The system will prompt you to enter a password. Passwords do not echo to the screen when you enter them. Therefore you will not be able to see the new password as plain text.
Changing the Password For Your Own Account
You can also change your own password, by typing ``passwd'' (do not specify a username). You will be prompted to enter your old password for verification, and then a new password. Changing the root password is done using the same process. You will of course have to be logged in to the root account.
Tips for creating a secure password.
Traditional advice when creating a password for a user is to use the following requirements.
- Use 12 Characters minimum: The more characters you use the better.
- Include special characters such as capital letters, lowercase letters, numbers and symbols: Using a mix of different characters will make your password harder to crack
- Try to stay away from using common dictionary words. Common dictionary words such as book or chairs are easily guessed.
- Use substitutions: Using a substitution for certain characters can make guessing your password difficult. Try to stay away from obvious substitutions. Ex. I = 1, 0 = O, S = 5
Creating a password such as “BookChair$1776” meets many of the suggested requirements but is technically a weak password. It has more than 12 characters, contains upper /lowercase letters, contains numbers and symbols. So why is it a week password? It contains two words from the dictionary, both are properly capitalized, and the numbers correspond to a famous date. These attributes make the password easy to guess.
The Pass Phrase Method
One trick to creating a secure password is using the pass phrase method. The pass phrase method uses a specific phrase to create a password. For instance, if I use the phrase,
“I have dreamed a dream but now that dream has gone from me”
And use the first letter from each word as a character. I will generate the password,
“ihdadbntdhgfm”
Using this method appears to make your password a bunch of gibberish. So how do we make it even better its already more than 12 characters. However, it doesn’t contain any uppercase letters so let's add some. Make any character you like in the password uppercase for instance: “iHdaDbnTdhgFm” now that we have some uppercase and lowercase letters lets add some substitutions IE numbers and symbols. Randomly select a few characters from the password to substitute for symbols. In this example we will instead of the fourth character being an “a” we could substitute it for “@” however this is a common substitution and should be avoided. Let's instead use “&”. Why this symbol well spelled out ampersand starts with an “a” so it's easy to remember. Also, the meaning of the symbol is “and” which will be misleading to anyone trying to figure out your password. Use as many symbol substitutions as you like.
So now our password is “iHd&DbnTdhgFm” and follows three of the recommended tips for creating a password.
Next let's add some random numbers to the password. But what numbers and where how do we make them random. I like to use at least 4 numbers. Kind of like how a charge card uses as a 4-digit pin. For this instance we will use the random number “6841” now where do we put these numbers in our password? Let's look at our original phrase “I have dreamed a dream. But now that dream has gone from me”. I want to put some numbers at the beginning, some in the middle, and some at the end. Ex.
“6 I have dreamed a dream. 84 But now that dream has gone from me 1”
Using the previous tips as well as adding numbers we get the password,
“6iHd&D84bnTdhgFm1”
This is a very strong password which after a few uses will be easy to remember.
Following the guidelines and pass phrase method will in theory create a secure password every time. however, no password is truly infallible and with time could be cracked so it is a good idea to change your password often. We hope these tips for creating a more secure password help you to keep your servers as well as your personal machines safe from intruders. If you have any further questions regarding password security, please reach out to support at 1-866-Hostway. Support is always available to answers any questions or address any concerns.