Chapter 4. Users, Passwords, and Authentication
Good account security is part of your first line of defense against
system abuse. People trying to gain unauthorized access to your
system often try to acquire the usernames and passwords of legitimate
users. After an attacker gains initial access, he is free to snoop
around, looking for other security holes to exploit to attain
successively higher privileges. It's much easier to
compromise a system from a local account than from outside.
Because most internal users are not malicious, many systems have
better defenses against outsiders than against authorized users.
Accordingly, the best way to keep your system secure is to keep
unauthorized users out of the system in the first place. This means
teaching your users what good account security means and making sure
they adhere to good security practices.
This chapter explains the Unix user account and password systems.
We'll explain these basic concepts, discuss the
mechanics for picking and maintaining a good password, and finally
show you how passwords are implemented in the Unix environment. In
Chapter 19, we'll describe in
detail how to protect your accounts from many different types of
attacks.
Unfortunately, sometimes even good passwords aren't
sufficient. This is especially true in cases where passwords travel
across a network from one computer to another. Many passwords sent
over the network can be
sniffed—captured
as they cross over a network. Although there are many ways to protect
against sniffing, the best is to assume that it is going to happen
and make sure that the information sniffed is useless. You can do
that by assuring that all passwords sent over the network are
encrypted, by using nonreusable passwords, or by eliminating the need
to transmit passwords altogether through the use of public key
encryption.
|