Re: ssh scans

[matthew sporleder <msporleder%gmail.com@localhost>]

On Wed, Oct 28, 2009 at 6:50 PM, Greg A. Woods <woods%planix.com@localhost> 
wrote:
> At Tue, 27 Oct 2009 21:35:58 -0400, Steven Bellovin 
> <smb%cs.columbia.edu@localhost> wrote:
> Subject: Re: ssh scans
>>
>> My incident was on Linux, that being the supported OS at $DAYJOB...
>
> I thought most of the common GNU/Linux distributions had also integrated
> libcrack to provide for stronger password selection controls.  Perhaps
> it's not enabled by default and is poorly documented?
>

Even though the linux passwd commands tells you your passwords are
weak, it doesn't stop  you from setting them.  :)

Setting a strong password policy and enforcing it on the root user's
actions (maybe override with a flag to passwd) would help encourage
stronger passwords.