Suppose a non-root user was compromised over remote by malware that is now using su (tty or similar) trying to login as root, trying every possible password by bruteforcing.

assume: full disk encryption with a strong passsword is in place.

goal: secure root account password.

non-goals: Protecting password from offline attacks when an attacker manages to steal /etc/shadow and to use offline attacks against it is out of scope.

In this situation...

Are offline attacks against linux user account passwords possible?

When are strong linux user account passwords required?

Are strong linux account passwords required?

How many password can an attacker try against linux user accounts per second or per minute?

Can passsword bruteforcing against linux user account passwords be parallelized by the attacker and is bruteforcing only bound by the attackers available resources of CPU/RAM/etc.?

Or is passsword bruteforcing against linux user account passwords limited by su/pam or something? Can only be a limited number of passwords per second or per minute be tested?

Can su/pam/everything be added a (longer and longer becoming) delay when trying a wrong password to slow down bruteforce attacks?

How many random characters or dice words must a linux user account password have to be very secure? Are these the same requirements as for very secure FDE passwords or lower due to offline attacks not being possible against linux user account passwords?

  • You say that offline attacks are out of scope, but then you ask if offline attacks are possible. – forest Jul 7 '19 at 2:02
  • To clarify: physical access, remove hard drive, missing full disk encryption and offline attacks against /etc/shadow are out of scope. The main question is, can linux user accounts remotely compromised by malware run offline attacks against linux user account passwords or are these limited in their attempts by su/login/pam/whatsoever? – adrelanos Jul 7 '19 at 8:41
  • 4
    FDE has nothing to do with running systems! FDE protects dead (non-running) drives from offline attack. – user10216038 Jul 8 '19 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.