Linux system password attacks and hacker intrusion prevention

I can't help but claim a topic that everyone is so enthusiastic about. If you can find it, Let's briefly talk about the Linux system password attack and prevention.

In the early Linux system, the/etc/passwd file contains information of each user in the system. Of course, after a certain number and logic algorithm, the user's password puts an operation result (visible string) stored in the passwd file, the encryption strength is not high. As a result, Early hackers only need to get the/etc/passwd file, and the system has already captured half of it.

Later, with the increase in security level, there was a situation where passwords in the passwd file were separately encrypted, and the encrypted results and other auxiliary information were stored in the shadow file. You can use the/usr/sbin/authconfig program to set the storage format and encryption algorithm.

The password entered by the user upon logon is calculated and compared with the results in/etc/passwd and/etc/shadow. logon is allowed if it meets the requirements. Otherwise, logon is denied.

A strong and valid password should be at least 8 characters long. Do not use personal information (such as birthday, name, user name, do not connect phone numbers and numbers such as 2002, 2000, and 888 in the password. Common English words are also bad (because dictionary attack can be used ), it is better to have some non-letters (such as numbers, punctuation marks, and control characters) in the password. Be sure not to write them on paper or in computer files, A good way to select a password is to connect irrelevant letters with numbers or control characters and make up a length of no less than 8 characters.

To force the user to specify a strong password, modify the PASS_MIN_LEN parameter in the file/etc/login. defs (minimum password length ). At the same time, the password usage time should be limited to ensure regular password replacement. We recommend that you modify the parameter PASS_MIN_DAYS (password usage time ). General Linux settings 1 are shown.

498) this. style. width = 498; "border = 0>

Figure 1

Linux uses DES (Crypt as the encryption function) or MD5 (Md as the function) encryption algorithm. Due to the large amount of computing, they are almost difficult to reverse crack. The DES password ciphertext is a string with 13 ASCII characters, while the start character of the MD5 password ciphertext is always "$1 $ ". Okay, you know about it. Next, let's demonstrate it. As shown in figure 2, it is a Linux attacked Red Hat series. The attacker remotely overflows the server and obtains a logon interface with the root permission.

498) this. style. width = 498; "border = 0>

Figure 2

How do I know the password of the root user? The attacker opened the/etc/passwd file. 3.

498) this. style. width = 498; "border = 0>

Figure 3

It seems that the host account is encrypted with shadow. Continue to view/etc/shadow. 4.

498) this. style. width = 498; "border = 0>

Figure 4

The root colon is followed by the encrypted password. Start cracking.

There are many tools to Crack Linux passwords, such as John the Ripper, Crack by Alex Muffett and Cracker Jack. Among them, John the Ripper is the most powerful and fast.

Download/etc/shadow to your local device. First try John the Ripper in simple mode, but no result is displayed, as shown in Figure 5.

498) this. style. width = 498; "border = 0>

Figure 5

Next, let's look at the dictionary. In this example, the dictionary file is specified using "-w2.161.txt. Soon, the root password came out. It turned out to be "bigapple ". 6.

498) this. style. width = 498; "border = 0>

Figure 6

With the root password, it is convenient to enter the server later.