Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 15 Oct 2005 23:02:01 +0400
From: Solar Designer <>
Subject: Re: restricting john to eight character passwords

On Thu, Oct 13, 2005 at 01:28:46PM -0400, joe haldon wrote:
> On a solaris box recently the /etc/default/passwd file had a setting
> PASSLENGTH option to 8. Standard DES. Still it took a long time and was
> wondering if it would speed things up significantly to restrict the search
> to 8. Does that make better sense?

Yes, it does.

However, most of the time password policies like that are not strictly
enforced.  There may be ways to set a password bypassing this check in
the system (e.g., would this restriction apply to passwords set by root?
would it apply to expired ones forcibly changed upon login?), so not
checking for shorter passwords with John might not be wise.

Also, your mentioning "Standard DES" suggests that you're using John 1.6
rather than the newer development versions (which would call the same
thing "Traditional DES").  The development versions are much faster at
DES, so you can simply use those to speed things up.

> Maybe the other option is to only have
> eight char words in the dictionary file?

No.  The word mangling rules alter lengths, and wordlist-based cracking
is generally quite fast anyway.  It is "incremental" mode which you
should care about the most.  To set password lengths for that, edit the
MinLen and/or MaxLen settings in the appropriate [Incremental:...]
section in john.conf (or john.ini).

If you really want to not be trying candidate passwords shorter than 8
characters that are produced during wordlist-based cracking, you can
achieve that by suffixing each non-comment line in [List.Rules:Wordlist]
with ">7" (without the quotes).

> Anyway thanks for creating an awesome program.

You're welcome.

Alexander Peslyak <solar at>
GPG key ID: B35D3598  fp: 6429 0D7E F130 C13E C929  6447 73C3 A290 B35D 3598 - bringing security into open computing environments

Was I helpful?  Please give your feedback here:

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ