An interesting article published by security guru Bruce Schneier:
Blaming the victim is common in IT: users are to blame because they don't patch their systems, choose lousy passwords, fall for phishing attacks, and so on. But, while users are, and will continue to be, a major source of security problems, focusing on them is an unhelpful way to think.
=> Blaming the user is easy – but it's better to bypass them altogether
This is an user contributed article.
Choosing the password is only the first step; you have got to remember it. You can not remember 100s of password at a time. However, with the help of a password manager, you can organize passwords, host names, and PIN codes.
Like most of you, I love using Firefox and explaining the advantages of Firefox to others who use other browsers. Unlike other browsers, Firefox has huge list of excellent add-ons that will satisfy almost all of your requirements in using a browser. Following are the list of 7 powerful Firefox password related add-ons that will make your life in managing passwords very safe, secure and easy under Mac OS X, Linux / UNIX and Windows operating system.
[click to continue…]
PAM is a flexible mechanism for authenticating users. For example, you do not allow users to reuse recent passwords. This can be accomplished by using the remember option for the pam_unix or pam_unix2 (part of certain enterprise distro) PAM module. In this quick, blog post I am going to explain how to restrict use of previous passwords using pam_unix.so.
[click to continue…]
If you just want to see how secure your network is or you would like to audit your own network, and to determine the insecurity of cleartext network protocols then you need to use sniffer programs. There are tons of Network protocol analyzer for Unix and Linux exist that allows examination of data from a live network, or from a capture file on disk For example Ethereal is one of such a program.
However, if you just interested in a password related auditing then nothing can beat dsniff program. It is simple and easy to use. dsniff capture passwords through http, ftp, smtp, pop3, telnet and many other cleartext protocols. dsniff includes various sniffing utilities for penetration testing.
Step # 1: Install dsniff
Install dsniff under Debian / Ubuntu Linux:
# apt-get install dsniff
If you are using FreeBSD then you can install it using ports or binary package:
# pkg_add -r dsniff
On the other hand, use ports collection:
># cd /usr/ports/security/dsniff
# make; make install; make clean
Step # 2: Start dsniff
dsniff automatically detects and minimally parses each application protocol, only saving the interesting bits, and uses Berkeley DB as its output file format, only logging unique authentication attempts. Login as a root user and type dsniff command:
For example, if user use ftp, telnet, or other cleartext protocol then you can capture passwords:
03/16/06 23:34:02 udp 192.168.1.2.1195 -> router.161 (snmp)
03/16/06 23:36:10 tcp 192.168.1.2.49522 -> f100.somedomain.com.21 (ftp)
Depend upon this audit report:
- You can block cleartext port
- Educate your user and ask them to use secure version of each of these protocols