Taking a Business Centric Approach to Service Level Compliance
Business reliance on ever more complex computer systems increases every year. These systems are at the heart of business success
Auditing passwords is a worthwhile venture, particularly in an environment that deals with sensitive information. Because systems encrypt passwords when they store them, you really can't properly judge the strength of a password unless you try to crack it.
We suggest using a password-cracking tool such as John the Ripper. This tool works extremely well because it can crack MD5 passwords, which most systems currently use. In addition, it's much faster and more sophisticated than earlier password-cracking software such as Crack.
Once you've installed the tool, either from RPM or by compiling a copy yourself, you can set it to work. Keep in mind that John the Ripper uses a fair amount of CPU, but it will only use idle CPU time. However, copying the /etc/shadow file to a nonessential machine and running the tool on that, rather than a production machine, wouldn't be a bad idea either.
If you need to stop John the Ripper, press Ctrl+C. You can resume cracking passwords from where you left off by using the following:
$ john -restore
This tool comes with a fair-sized dictionary of common passwords, which it uses by default. However, you can download any dictionary you want to use instead of, or as complement to, the existing dictionary. All you need to do is concatenate the default.lst file to the new dictionary.
In addition, it's a good idea to add words that are specific to your particular environment, including employee names, addresses, company name, etc.
To use a different dictionary than the default, use the following:
# john -wordfile:/tmp/dict.txt /etc/shadow
This runs John the Ripper against the passwords in /etc/shadow using the dictionary /etc/dict.txt.
To download the John the Ripper password cracker, visit the Openwall Project Web site.
In order to post a comment you need to be registered and logged in
Log in or create your ZDNet UK account below
By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ
Well, it’s amazing. The miracle has been done. Hat’s off. Well done, as we know that “hard work always pays off”, after a long struggle...
5 hours ago by mgibs17 on Salesforce chief: Enterprise tech lacks innovationWell, it’s amazing. The miracle has been done. Hat’s off. Well done, as we know that “hard work always pays off”, after a long struggle...
5 hours ago by mgibs17 on Govt to review US extradition treatyomg!!!! I been using read hat linux for a while sience 1998 and i recently got tire of that distor and tryed slackware 13.1.... i no longer want...
9 hours ago by OpenSourceLinux on Slackware Linux 13.1omg!!!! I been using read hat linux for a while sience 1998 and i recently got tire of that distor and tryed slackware 13.1.... i no longer want...
9 hours ago by OpenSourceLinuxSpeaking purely from observation, I've seen only a handful of people actually using netbooks (and have one myself). None of them were running...
10 hours ago by Tezzer on While PC shipments will grow to a million per day, netbooks are in declineImagine how stupid ZDnet must feel considering it takes about 10-30 seconds to load their stupid webpage filled with ads from other sites. While...
11 hours ago by WasteOfTime on Google’s Buckyballs doodle costs people money, drives users awayUnfortunately AnAmericanFellow you seem to be in the minority. ;)
11 hours ago by SeanTheMac on Google’s Buckyballs doodle costs people money, drives users away@manek - No, I'm saying that there are concrete statements from netbook manufacturers and REPUTABLE analysts that indicate the Linux share of the...
12 hours ago by J.A. Watson on While PC shipments will grow to a million per day, netbooks are in declineMary : Being familiar with both Windows and Linux extensively, I would be curious to know what kinds of learning issues there were with Linux...
12 hours ago by apexwm on While PC shipments will grow to a million per day, netbooks are in declineI always thought that Wave was ideal for machines and lousy for humans...
12 hours ago by sbisson on Forcing Things SocialAny news on when we'll see the putative benefits? It would be nice to see an uninterrupted data connection - even a 2G one - on a a train journey I...
13 hours ago by manek on Ofcom pumps up the volume for 3G networksSo you're saying that some 25 percent of netbook buyers throw away a copy of Windows they've paid for and install Linux instead. If netbook users...
13 hours ago by manek on While PC shipments will grow to a million per day, netbooks are in declineJamie, you bring up a good point. There hasn't been much news regarding netbooks in a while, especially on what they are running. Jack doesn't...
14 hours ago by apexwm on While PC shipments will grow to a million per day, netbooks are in declineOn behalf of all Americans, I would like to apologise for the twit that insisted on the American spelling of 'realized'. Some of us are aware of...
15 hours ago by AnAmericanFellow on Google’s Buckyballs doodle costs people money, drives users awayIE 7? It uses all that CPU just to open a tab. Really, I saw those claims, really, most of them are, simply put, just full of BS. My machine isn't...
16 hours ago by feabandMmm. Google could do with something like this. It would be brave of them - in fact, they could call it Google Brave. Or Cave. Or something like that.
17 hours ago by Rupert Goodwins on Forcing Things Social"Linux being a disastrous failure in the netbook marketplace. (Linux went from 100% market share to less than 5%" Obviously untrue. Here is...
17 hours ago by J.A. Watson on While PC shipments will grow to a million per day, netbooks are in decline> just want my default browser to load quickly so I can then as effortlessly as possible type > the URL I do want to go to and be done with it. In...
17 hours ago by Chris Rankin on Google’s Buckyballs doodle costs people money, drives users awayI always use Google as a home page for any PC I work on as I just want my default browser to load quickly so I can then as effortlessly as possible...
18 hours ago by eldridgep on Google’s Buckyballs doodle costs people money, drives users awayBusiness reliance on ever more complex computer systems increases every year. These systems are at the heart of business success
Double-Take Move provides migration functionality that dramatically reduces the impact and risk of migrations in the data center..
Accounting and other business systems are packed with useful, and often critical, business information which can be turned to competitive
Talkback
Having pressed on the link and tried to download the 'John the Ripper' program, my PC Antivirus (NOD32) alarms and reports that the file is a trojan.
Lets hope other unsuspecting people who are not IT literate dont install this program.
Great idea to put a link to a trojan on your website!!!!
Keep up the good word ZDNet. Please ensure you put a warning on the page to alert people and in future CHECK sources are legit.
Thats essentially an Antivirus for windows
Or you could just enforce complexity and password length along with password history.
If I'm willing to give you my password in exchange for a coupon for a cup of coffee, does it really matter how "complex" it is?
You have to wonder how many of the people who sold their passwords so cheaply did it as a way of getting back at IT security departments who'd made their lives a misery for so long.
I doubt anybody actually gave them real passwords...or gave them to "spite" an IT department. Most people don't live under such a jaded mindset as yourself. But if somone was going to give me some STarbucks for "my" password. I would come up with yet another one of "my" passwords and give it to them.
That was an insanely stupid test. Even so, back to the point of the article -- if you are cracking and revealing passwords and then somebody else knows the passwords (the pasword cracker) then why not give them away because then they are useless. Thus cracking passwords is contradictory to the spirirt of most corporate policies that forbid giving somebody else your password.
yes, yes, this is all good and well, and having downloaded this program "John the Ripper" about 5 times and trying to instal it about 17 times, i wonder why i even bothered. it's all great and lovely that it works for you, but what about the rest of us? i am at a complete loss as to how to install this thing. yes, i read the readme and install stuffs, but aparrently the files i needed weren't downloaded. i probably sound stupid and ignorent but i'm slightly agitated that it's not working for me.
I want to crack program with protoctoin
I need to learn how i can do?
Hello,
I'm Japanese. I'm not good at English.
The originap page(http://www.openwall.com/john/) with [John the Ripper 1.6 (Win32 - binaries, 763 KB)] with Trjyan.
Normal?? Abnormal??
Reading Thank you.
To the person that wrote the text below you are obviously it illiterate your self as many people know that Windows AV will pick up any sort of cracking / hacking tools as trojans.
Having pressed on the link and tried to download the 'John the Ripper' program, my PC Antivirus (NOD32) alarms and reports that the file is a trojan.
Lets hope other unsuspecting people who are not IT literate dont install this program.
Great idea to put a link to a trojan on your website!!!!
Keep up the good word ZDNet. Please ensure you put a warning on the page to alert people and in future CHECK sources are legit.