Very Computer

by **Gumbe** » Sat, 22 Mar 1997 04:00:00

I have got my hands on a passwd file, I have run a dic. on it but nothing
worked, what am I going to do?

by **Chery** » Sat, 22 Mar 1997 04:00:00

Quote:> I have got my hands on a passwd file, I have run a dic. on it but nothing
> worked, what am I going to do?

Be surprised that all your users have decent passwords set? ;-)

rgds
Cheryl

by **Jerome O'Nei** » Sat, 22 Mar 1997 04:00:00

> I have got my hands on a passwd file, I have run a dic. on it but nothing
> worked, what am I going to do?

Turn youself in to the local authorities.

Jerome

by **Scott Norwo** » Sun, 23 Mar 1997 04:00:00

>> I have got my hands on a passwd file, I have run a dic. on it but nothing
>> worked, what am I going to do?

>Turn youself in to the local authorities.

Hey, there's nothing wrong with running a passwd file through 'Crack'
or something similar. Just because he wants to crack the file doesn't
mean that he's going to actually login as someone else. Actually, he may
even help to secure the system, if afterwards he encourages the users
with insecure passwords to change them and/or encourages the admin. to
install npasswd.

I've cracked several passwd files, with absolutely no intention of using
the cracked accounts; it was merely an exercise to see a) how various
cracker programs go about the task and b) how much time (both CPU time
and real time) it would take to crack various-size passwd files. When
I finished, I deleted the cracked files from my machine.

Of course, this guy may just be "an 3l337 WaReZ d00d," in which case,
I'll leave password cracking as an excercise to the reader. :)

--
<html><head><title>Down with HTML news postings!</title></head><body>
<h1><blink>If this line blinks, then it's time to get a newsreader that
doesn't encourage HTML news posting! There are many that are better
than Netscape or IE; try trn!</blink></h1></body></html>

by **S. Sho** » Sun, 23 Mar 1997 04:00:00

Quote:>I have got my hands on a passwd file, I have run a dic. on it but nothing
>worked, what am I going to do?

Here... give it to me. :)

by **Piotr T Zbiegie** » Tue, 25 Mar 1997 04:00:00

> >> I have got my hands on a passwd file, I have run a dic. on it but nothing
> >> worked, what am I going to do?

> >Turn youself in to the local authorities.

> Hey, there's nothing wrong with running a passwd file through 'Crack'
> or something similar. Just because he wants to crack the file doesn't
> mean that he's going to actually login as someone else. Actually, he may
> even help to secure the system, if afterwards he encourages the users
> with insecure passwords to change them and/or encourages the admin. to
> install npasswd.

> I've cracked several passwd files, with absolutely no intention of using
> the cracked accounts; it was merely an exercise to see a) how various
> cracker programs go about the task and b) how much time (both CPU time
> and real time) it would take to crack various-size passwd files. When
> I finished, I deleted the cracked files from my machine.

> Of course, this guy may just be "an 3l337 WaReZ d00d," in which case,
> I'll leave password cracking as an excercise to the reader. :)

Let's make a distinction here, there *IS* something wrong with having
Joe User run Crack on a passwd file. If Joe User is not the sys admin
*or* the admin hasn't given Joe User permission to attack his
machine(Great exercise for your security if you have a admin buddy you
can trust;), then I really don't care *WHY* Joe User is cracking my
machine, or for that matter running Satan on it, etc, etc. On the
systems I have used and administered in the past there has been a
zero-tolerance rule on things like running Crack or Satan. If you are
running it on my system, I'd lock your account and chances are you would
get on my sh*t list. Not to be harsh, but the cold hard facts is that I
do not know why you are running it and I'm not gonna sit around and hope
that you are gonna present me with a security report at the end of the
month.

Aren't we being a little naive if we are goind to allow Joe User to run
all sorts of nastly little programs on our system with the hope that
he's doing it to help us out? C'mon, how many users would actually do
that out of the goodness of their hearts. And anyway, how many of us
actually *like* having all our security pointed out and being told how
to do our jobs;)

Just my 0.02, I expect change.
Piotr

----------------
Piotr T Zbiegiel
Unix Systems Specialist
Berk & Hirt Consulting Co.

by **Piotr T Zbiegie** » Wed, 26 Mar 1997 04:00:00

> What you people also have to realise is that it's often the people who
> have something (shady?) to hide that get into such a tizzy about
> security. It's so easy to make inflexible rules, and then take the
> high m*ground when someone suggests the contrary. Perhaps some
> people in this newsgroup have something to hide as well?

Ummm, or maybe we are systems administrators that actually care about
keeping our sites in working condition. I guess it is difficult to
explain if you are not a systems administrator but your job *RELIES* on
the machine working at all times and that sensitive information stays
private. Maybe you should take a look at the SAGE code of ethics and
the ACM code of ethics and come back when you've studied up. I get in a
tizzy about security because that's part of my job.

I agree, *some* people in this newsgroup have alterior motives to hide.
But I'm sure they are not wasting their time posting about high m*
ground, they are too busy posting "I need help cracking passwd file"
messages.

Peace
P T Z
--
Piotr T Zbiegiel
Unix Systems Specialist
Berk & Hirt Consulting Co.

by **Scott Norwo** » Wed, 26 Mar 1997 04:00:00

Quote:
>I agree, *some* people in this newsgroup have alterior motives to hide.
>But I'm sure they are not wasting their time posting about high m*
>ground, they are too busy posting "I need help cracking passwd file"
>messages.

And, of course, by starting threads with that kind of subject head,
they're not doing a very good job of hiding anything. :) I have
to admit, though, that this has been one of the strangest and most
interesting threads to come through here in a couple of weeks, at
least... Hopefully it won't soon be followed by 'I have an account
on XYZ system running OS version x.x.x; how do I get root?'. :)

--
<html><head><title>Down with HTML news postings!</title></head><body>
<h1><blink>If this line blinks, then it's time to get a newsreader that
doesn't encourage HTML news posting! There are many that are better
than Netscape or IE; try trn!</blink></h1></body></html>

by **Sean A. Walbe** » Wed, 26 Mar 1997 04:00:00

>What you people also have to realise is that it's often the people who
>have something (shady?) to hide that get into such a tizzy about
>security. It's so easy to make inflexible rules, and then take the
>high m*ground when someone suggests the contrary. Perhaps some
>people in this newsgroup have something to hide as well?

What? Some (many?) of us make our money administering systems. If
someone is hacking around *my* system, you're damn sure he's getting
the boot. I have a responsibility to the users on my system (in my
case, over 4000) to protect their system. What do I say to them when
their mail gets read unauthorized? What do I say when they can't have
their web site up, especially when some of them base their entire
business on it?

It has been said that there are two approaches to security, that which
is not expressly prohibited is allowed, and that which is not
expressly allowed is prohibited. The former may work at the
university, but in the real world the latter is the only option.

I don't know of any sysadm worth his salt that doesn't cringe at the
possiblity of his password file being comprimised.

I'm not hiding anything, I'm doing my job.

by **Scott Norwo** » Wed, 26 Mar 1997 04:00:00

>Any unauthorised attempt to gain access to a system you don't own is the
>low m*ground, and by default places me, and people who feel like I do
>on the high m*ground.

Agreed, wholehartedly.

--
<html><head><title>Down with HTML news postings!</title></head><body>
<h1><blink>If this line blinks, then it's time to get a newsreader that
doesn't encourage HTML news posting! There are many that are better
than Netscape or IE; try trn!</blink></h1></body></html>

by **Kenneth L. Hame** » Wed, 26 Mar 1997 04:00:00

> What you people also have to realise is that it's often the people who
> have something (shady?) to hide that get into such a tizzy about
> security. It's so easy to make inflexible rules, and then take the
> high m*ground when someone suggests the contrary. Perhaps some
> people in this newsgroup have something to hide as well?

You're absolutely right. As a sysadmin, I have a _lot_ to hide. All of
the private data which my users entrust to my system and my care, for
one thing. So I'm really not sure what you're trying to imply here -
that it is imm*or illegal to hide private information?

Count me as another person who has ZERO tolerance for uninvited
exploration of my system security. At the same time, I find the entire
subject fascinating, and have happily discussed the issue with users
when they had the basic sense to come to me and ask permission to
explore the subject on our systems.

Back on the subject, I tend to think if you can't read and understand
the copious documentation out there on how to attack the UNIX password
system, then you don't have any business messing with it. You have to
show _some_ level of capability after all.

- Ken

===
Kenneth L. Hamer, CCSO Departmental User Services Consultant/Network
Analyst for the Department of Astronomy and Extramural Programs / CEPS
===
As a computer, I find your faith in technology amusing.

Very Computer

Need help cracking passwd file!!

Need help cracking passwd file!!

Need help cracking passwd file!!

Need help cracking passwd file!!

Need help cracking passwd file!!

Need help cracking passwd file!!

Need help cracking passwd file!!

Need help cracking passwd file!!

Need help cracking passwd file!!

Need help cracking passwd file!!

Need help cracking passwd file!!

Need help cracking passwd file!!