Question

Time to time administrators check password files for weak passwords.

a) Name three tools in Linux you would use to test for weak passwords?

b) Describe how /etc/shadows stores a password on Linux hosts?

c) Explain how a brute force password on /etc/shadow would work on linux ?

Answer 1

(a)

Three password cracking tools used are:

• Hydra - It is a login cracker that supports multiple protocols for attacking like Cisco enable, SOCKS5, Teamspeak, Oracle Listener, MySQL, etc.
• Johnny - It is GUI for John Ripper password cracking tool.
• Rainbowcrack - This tool cracks hashes through rainbow lookup table

(b)

etc/shadow file store actual password by using in encrypted format & other information like user name, value of password expiration, change date of a password. It consists of text file & is readable only by root user, so possess less security risk.