|
Message-ID: <20051015190200.GB1017@openwall.com> Date: Sat, 15 Oct 2005 23:02:01 +0400 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: restricting john to eight character passwords On Thu, Oct 13, 2005 at 01:28:46PM -0400, joe haldon wrote: > On a solaris box recently the /etc/default/passwd file had a setting > PASSLENGTH option to 8. Standard DES. Still it took a long time and was > wondering if it would speed things up significantly to restrict the search > to 8. Does that make better sense? Yes, it does. However, most of the time password policies like that are not strictly enforced. There may be ways to set a password bypassing this check in the system (e.g., would this restriction apply to passwords set by root? would it apply to expired ones forcibly changed upon login?), so not checking for shorter passwords with John might not be wise. Also, your mentioning "Standard DES" suggests that you're using John 1.6 rather than the newer development versions (which would call the same thing "Traditional DES"). The development versions are much faster at DES, so you can simply use those to speed things up. > Maybe the other option is to only have > eight char words in the dictionary file? No. The word mangling rules alter lengths, and wordlist-based cracking is generally quite fast anyway. It is "incremental" mode which you should care about the most. To set password lengths for that, edit the MinLen and/or MaxLen settings in the appropriate [Incremental:...] section in john.conf (or john.ini). If you really want to not be trying candidate passwords shorter than 8 characters that are produced during wordlist-based cracking, you can achieve that by suffixing each non-comment line in [List.Rules:Wordlist] with ">7" (without the quotes). > Anyway thanks for creating an awesome program. You're welcome. -- Alexander Peslyak <solar at openwall.com> GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598 http://www.openwall.com - bringing security into open computing environments Was I helpful? Please give your feedback here: http://rate.affero.net/solar
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.