32

Chapter 4. Workstation Security

Do Not Invert Recognizable Words   Good password checkers always reverse common

words, so inverting a bad password does not make it any more secure.

Some examples include the following:

R0X4H

nauj

9 DS

Do Not Write Down Your Password   Never store your password on paper. It is much safer

to memorize it.

Do Not Use the Same Password For All Machines   It is important that you make separate

passwords for each machine. This way if one system is compromised, all of your machines

will not be immediately at risk.

Do the Following:

Make the Password At Least Eight Characters Long   The longer the password is, the bet 

ter. If you are using MD5 passwords, it should be 15 characters long or longer. With DES

passwords, use the maximum length   eight characters.

Mix Upper and Lower Case Letters   Red Hat Linux is case sensitive, so by mixing cases,

you will enhance the strength of the password.

Mix Letters and Numbers   Adding numbers to passwords, especially when added to the

middle (not just at the beginning or the end), can enhance password strength.

Include Non Alphanumeric Characters   Special characters such as &, $, and

can greatly

improve the strength of a password.

Pick a Password You Can Remember   The best password in the world does you little good

if you cannot remember it. So use acronyms or other mnemonic devices to aid in memorizing

passwords.

With all these rules, it may seem difficult to create a password meeting all of the criteria for good

passwords while avoiding the traits of a bad one. Fortunately, there are some simple steps one can

take to generate a memorable, secure password.

4.3.1.1. Secure Password Creation Methodology

There are many methods people use to create secure passwords. One of the more popular methods

involves acronyms. For example:

Think of a memorable phrase, such as:

"over the hills and far away, to grandmothers house we go."

Next, turn it into an acronym (including the punctuation).

othafa,tgmhwg.

Add complexity by substituting numbers and symbols for letters in the acronym. For example,

substitute 7 for t and the at symbol (@) for a:

o7h@f@,7gmhwg.