Re: Fedora Core 3 & Core 4 Password questions

From: Moe Trin (ibuprofin_at_painkiller.example.tld)
Date: 08/09/05 

Date: Tue, 09 Aug 2005 15:11:10 -0500

In the Usenet newsgroup alt.computer.security, in article
<xlZJe.153280$5V4.129554@pd7tw3no>, Brandon wrote:

>Is there any length of complex password that can be assigned to the ROOT
>that cannot be hacked if the person hacking has console access?

Console access? Why bother hacking when there are quite obvious ways
around it from that point.

>I am selling a software product that I do not want the users to have
>access to.

Then don't install it on the users hardware, or hardware that the users
have access to.

>The only account on the server will be ROOT. I wanted to use a password
>32 characters/numbers/symbols or higher.

With the modern MD-5 hash system, this is easy - after all, you want to be
the only person with root, so you can set the password as you like. Of
course, it only takes a few minutes AT MOST to bypass this.

>Main thing is no one must get in.

Physical access beats five aces. If you want the system to be totally
secure, encrypt the drive, and require the password to be entered each
time the system boots. You can't keep the password on the system, or
allow it to be entered over the network, as either method can be compromised
very easily. Not practical, you say? Neither is your desire to prevent
anyone from accessing the software.

        Old guy