
    Obvious Passwords

    One of the most frequent invasions of computer systems is not
    through a complex or back door trick, but through the front door via
    the login program. This is what "password crackers" do. So, simple
    account passwords can be a high security risk.

    Novice users frequently choose very simplistic passwords. While some
    systems have password programs to force some variation of simple
    passwords, the protection is usually minimal. You can use the
    Obvious Password security check to get a list of users with easily
    detectable passwords.

    This program runs obvious password checks on:

    + The user's login name
    + The passwd file on the machine (hostname)
    + All words in the user's Realname, Phone number and Office user
      account fields of the passwd file

    after you fill in the relevant data fields in the Password Check
    Parameters window shown below.

    Since users have the ability to change their passwords at any time,
    you should run this security check frequently. Keeping a historical
    reference will also provide some insight into your own users'
    password habits.

    Levels of Checking

    There are three levels of Obvious Password Checking you can select,
    with level one being the lowest and each subsequent level
    encompassing the previous levels:

    1) Obvious Passwords

    Passwords that closely match the account name. Each user takes
    approximately 5 seconds to check.

    2) Common Names

    Passwords matching proper names, a frequent choices of novice users.
    Each user takes approximately 5 minutes to check.

    3) Common Words

    Passwords found in a common use dictionary. Each user takes
    approximately 30 minutes to check.

    Who is Checked

    Click on the right arrows in the Password Check Parameters window
    for lists of the users, groups, and hosts on the system. You can use
    these to target specific users and/or groups for the checking
    process.

    For the Users and Groups windows, you will be presented with the
    users and groups in the current system pool. Choosing a user or
    group will cause all occurrences of that user and/or group to be
    checked across the hosts in that system pool. For the Hosts window,
    selecting a host will check all users on that host.

    Instead of using the above process, you may also choose to examine
    only specific targets by using the Additional Users field. Use the
    format hostname:username to specify these entries. The following
    example tests user johnf on host rome and all users on host paris.

    Additional Users: rome:johnf paris:

    Whichever method you use, when you are finished, click on the Apply
    button. The time required to execute the testing process depends on
    the number of users to check and the level of checking. When this
    check is done, a list of users with obvious passwords appears in the
    form of the Configure Users window.

    At this point, you could select a subset of the users and lock them
    out, obtain a list of their current processes, change their
    passwords, e-mail an "Obvious Password" letter to them, or even
    delete them.

    What is Checked

    All Options

    Enlighten will check each word in the generated list of potentially
    obvious passwords as follows:

    + As entered
    + In all lower case letters
    + In all upper case letters
    + Capitalized first letter, the rest in lower case.

    Each of these checks will be performed on the actual word as well as
    its reverse. For example, `Mirror' will be checked as Mirror,
    rorriM, mirror, rorrim, MIRROR, RORRIM.

    This program will also check for accounts with no password, empty
    passwords and other obvious passwords such as "secret", "computer",
    "hello", etc.

    The Common Names Option

    The second level of password checking checks a list of 4000 names
    for possible matches. This list of names is found in the file
    $ENLIGHTEN/config/names. You may modify this file to fit your
    working environment.

    Entries in the file are checked as is, from first to last, and any
    deviations such as capitalization or backwards spelling are not
    made. If you want these deviations to be checked, you need to add
    them sequentially as entries in the file.

