The classical recommendation for a salt for password hashing is:

 - A [random value of 128 bits or more][1];
 - obtained from a cryptographically sound random number generator ([`/dev/random` or `/dev/urandom`][2] on modern day Unixes);
 - unique for each entry (i.e. a new salt for each password hash);
 - stored in plaintext in the database (so that the salt is available when verifying the hash).

There are plenty of [past discussions of related topics][3]. And most importantly, you should **not** implement your own password hashing scheme -- you should use a [proven, well tested, peer reviewed implementation][4].


  [1]: http://security.stackexchange.com/questions/5504/what-are-the-most-common-password-salting-methods/5506#5506
  [2]: http://en.wikipedia.org/wiki//dev/random
  [3]: http://security.stackexchange.com/questions/tagged/passwords
  [4]: http://security.stackexchange.com/questions/4781/do-any-security-experts-recommend-bcrypt-for-password-storage