Practical UNIX and Internet Security, 3rd Edition

Chapter 4. Users, Passwords, and Authentication

Good account security is part of your first line of defense against system abuse. People trying to gain unauthorized access to your system often try to acquire the usernames and passwords of legitimate users. After an attacker gains initial access, he is free to snoop around, looking for other security holes to exploit to attain successively higher privileges. It’s much easier to compromise a system from a local account than from outside.^[30]

Because most internal users are not malicious, many systems have better defenses against outsiders than against authorized users. Accordingly, the best way to keep your system secure is to keep unauthorized users out of the system in the first place. This means teaching your users what good account security means and making sure they adhere to good security practices.

This chapter explains the Unix user account and password systems. We’ll explain these basic concepts, discuss the mechanics for picking and maintaining a good password, and finally show you how passwords are implemented in the Unix environment. In Chapter 19, we’ll describe in detail how to protect your accounts from many different types of attacks.

Unfortunately, sometimes even good passwords aren’t sufficient. This is especially true in cases where passwords travel across a network from one computer to another. Many passwords sent over the network can be sniffed —captured as they cross over a network. Although there are many ways ...