9

There are two situations in which 'default' passwords get used on a network:

  1. A new user is registered. In her registration pack, along with her new username, e-mail address and so on is her initial password.

  2. A new piece of hardware is deployed. In its factory state it has a default admin password so you can go in and configure the hardware.

How can I check for these default passwords still being used on my network, and enforce that they get changed?

11
  • 1
    Can you give some more information, context, etc? What "default password" are you talking about?
    – AviD
    Feb 1, 2011 at 15:41
  • 1
    From a technical side, are you trying to actively solve the problem, and if so is it a particular OS, webapp, etc?
    – Scott Pack
    Feb 1, 2011 at 16:14
  • 5
    "it depends". See the faq for advice on putting questions in context
    – nealmcb
    Feb 1, 2011 at 16:47
  • 1
    This question definitely needs some context.
    – Iszi
    Feb 1, 2011 at 20:27
  • 2
    @Iszi Yeah, a bit of a bugbear of mine with the SE system. It also means that people are more inclined to write their own answer referencing an existing answer, rather than tidying up/adding to an existing good answer.
    – user185
    Feb 4, 2011 at 21:58

6 Answers 6

10

So much depends on context - see @nealmcb comment.

If it's for an operating system, most OS's these days offer a setting for "change on first use"

If it's for an application you control, don't provide users with a default password - generate a unique password for them which expires on first use.

If it's a device shipped from vendor - trickier, unless you can persuade the vendor to do this for you.

In summary - various different options, but you need to place the question in context or you may not get useful answers. See the "what background" section in the faq.

1
  • +1. It might also help to define an internal policy that requires devices with no default passwords, or at least that those devices can be managed as soon as they connect to the network and have their default passwords changed.
    – Alex Holst
    Feb 2, 2011 at 19:01
6

One way I have read about is, to have a default password which says the"admin'sname"rocks sort of a password. Most users change that. Can you think of anything else?

Use systems that don't have a default password.

6

A new user is registered. In her registration pack, along with her new username, e-mail address and so on is her initial password.

Several things need to be taken into consideration here.

Firstly, how are the username and password transferred to the user? Is it passed along on hardcopy, or does it go to an intermediary (i.e.: Supervisor or Admin Assistant) via electronic means? If the former, it should be kept in a sealed, opaque, tamper-evident package from the sysadmin to the user. If the latter, the sysadmin should relay the information via encrypted e-mail to the intermediary who then uses a secure package (as described earlier) to transfer it to the user. However, it is preferable that there be no third parties involved in this transaction - ideally, only the sysadmin and the user should have knowledge of or access to the first-time password. More preferable would be that only the user has it, but this is not possible in some scenarios - such as for domain or e-mail accounts.

Second, first-time passwords should always be unique and not determinable by any information unique to the user. The best way to ensure this is to use a random password generation tool, and do not reuse the generated passwords between users. Ideally, the username should have no relation to any personally identifiable information either.

Third, the mechanism for ensuring first-time passwords are changed is very dependent upon the environment that the account is created in. Many systems have an option that can be set on accounts to force the user to change the password upon their next login. If that is available, it is the most effective means and should be used. For systems without such a feature, you are left very dependent upon the user to conform to company policy. This can be helped along by including a clear and prominent advisory about changing the password in the registration pack. Also, using a very long and complex (around 20+ random characters using all available character types should do) first-time password will naturally make the user more inclined to change it.

Lastly, if you are taking appropriate measures as specified above, auditing password changes may be difficult. If you're using a password cracking tool such as Ophcrack or LophtCrack to check this, you will have to add every individual's first-time password to the rainbow table as they are created. Some systems include the ability to check the user's password age and last login time - these can be checked against the account's creation date and the user's start date to see if the user changed it on first login. Aside from those methods, the high security of the techniques described above makes verifying first-time password changes almost as difficult as exploiting the first-time password itself.

A new piece of hardware is deployed. In its factory state it has a default admin password so you can go in and configure the hardware.

There are a few measures to be taken here, which can make the first-time password more secure and help facilitate and verify their change.

The first piece comes in materials acquisition. Try to only purchase hardware which:

  • Does not have a first-time password, and will not operate until the sysadmin has configured a password.

  • If it has a first-time password, uses one which is uniquely generated for each device and not reused between units.

After this, the only way to ensure they are being changed is often through a hands-on audit of the system, checking to see if the first-time credentials are still valid.

3

Test passwords periodically, and make sure that's in your dictionary.

3

Without additional info/context, one way might be to set a long, complex passphrase which would be tedious to repeatedly type out.

If the system supports it, "change on first use" would certainly be preferred.

1
  • 2
    +1 - Where there's absolutely no other method available, I try to set the longest and most complex password that the system and my random generator will support. Probably around 20 characters, using all four character types, and using an automated random generator, should do the job.
    – Iszi
    Feb 2, 2011 at 6:46
2

Our system default passwords are one use only and our application passwords are special default depending on the application. We know what the default password looks like in each application so it is easy to search for the defaults and get to the offending parties.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .