Implementing a Network in Software

Creation PDF417 in Software Implementing a Network

FIGURE 9-8

information is stored in /etc /passwd, and the user s encrypted password is stored in /etc /shadow Any group the user is a member of is re ected in /etc /group

When creating your user accounts, make sure that you create strong passwords Make sure also that when users changes their passwords, they also follow guidelines for strong passwords What is a strong password A strong, or complex, password is one that meets the following requirements:

It is not the same as the user s logon name It has a minimum of six (preferably 8) characters It uses a mixture of uppercase and lowercase characters It uses a mixture of letters, numbers, and symbols

The problem lies in making sure that users follow these guidelines It is extremely easy to explain to users that they should not choose their pet name as a password, but you need to be certain that when you walk away they don t change their password to a weak one that can be easily guessed To ensure that passwords are strong passwords you can build a password policy A password policy, once enabled,

TABLE 9-2

Enforcing password history means that the server maintains a given number of passwords previously chosen by a user and the user will not be able to choose a password that was already used within the duration of that history For example, I normally con gure my servers to remember at least 12 passwords, so users will not be able to reuse a password that they have chosen 12 times ago This setting limits the user to having a password for a maximum amount of time Normally, I set this to 30 days, which means that the user can keep a password for 30 days; after that it will expire, and the user will need to set a new one Setting the minimum password age means that a user cannot change their password for the amount of time speci ed after it has been changed For example, if you force the user to change their password every 30 days you may not want them to change it for a minimum of 2 days after that so you can set the minimum password age to 2 The password must have a minimum number of characters The more characters in a password, the harder it is to crack, because you have increased the number of potential characters Eight characters or more is the recommendation for minimum password length This is de nitely a setting that should be enabled on any server that will hold the network accounts Enabling complexity requirements means that the passwords must be strong and meet the conditions mentioned previously a mixture of letters and numbers and employing uppercase and lowercase characters

9:

FIGURE 9-9

will not allow users to have weak passwords Table 9-2 lists some popular password policy settings To con gure a password policy in your Windows networking environment, select Start | Administrative Tools | Default Domain Controller Policy Once in the Domain Controller Policy, expand Account Policies and then select Password Policy, as shown in Figure 9-9 Exercise 9-4 demonstrates how to create a strong password policy

EXERCISE 9-4

In this exercise you will learn to create a password policy in Windows 2003 on your domain controller so that the policy affects the domain accounts 1 Select Start | Administrative Tools | Domain Controller Security Policy (as shown in the following illustration)

9:

2 Expand Account Policy and select Password Policy on the left side (as shown in the following illustration)

3 Double-click Maximum password age on the right side of the screen to set the maximum number of days a user is allowed to keep his or her password 4 Choose De ne this policy and type 30 days as the time when the password will expire (as shown in the following illustration)