One till password for everybody
A café has one password for its till, and every member of staff knows it. It is written on a sticky note under the counter.
A worker left in the summer. She still knows the password. Nobody can tell who rang up a refund last Tuesday, because every sign-in looks the same.
Good account rules fix both problems.
The one rule
Warning
This lab is a machine with mistakes left in on purpose. Work only on your own private copy, and only because your teacher allows it. It has no way out to the internet. Trying this on a system that is not yours is a crime under the Computer Misuse Act 1990. We study weak spots so we can fix them.
By the end of this lesson
Note
I can set and check good rules for accounts.
Key words
| Word | What it means |
|---|---|
| Account | one person's way into a system |
| Password policy | the rules a password has to follow |
| Hash | a scrambled form of a password that cannot be turned back |
| Two-factor sign-in | needing two different kinds of proof to get in |
| Privilege | what an account is allowed to do |
| Leak | when private data gets out to people who should not have it |
The cells students fill in are left blank in this preview.
Before you start
Note
Press Start the lab on the bar at the top. The lab is a whole Ubuntu machine of your own. Each Run button types its command into the terminal. Every Run in this lesson only reads. If a Run says the machine is still starting, wait and press it again.
A long password is a strong password
An attacker guesses passwords with a computer that tries millions each second. Each extra character multiplies the number of guesses needed.
So a good policy asks for length first: twelve characters or more. Three or four random words make a long password you can remember.
It also refuses passwords on a list of common ones, because attackers try that list first. And it says: never use the same password on two sites.
Worked example: five passwords against the policy
| Password | Length | On the common list? | Verdict |
|---|---|---|---|
| cafe123 | 7 | Yes | Refuse: too short and common |
| Password1! | 10 | Yes | Refuse: too short and common |
| Tr0ub4dor | 9 | No | Refuse: too short |
| passwordpassword | 16 | Yes | Refuse: common, even though it is long |
| purple tram sandwich | 20 | No | Accept |
The cells students fill in are left blank in this preview.
The machine keeps a hash, not the password
A good system never stores your password itself. It stores a hash, a scrambled form that cannot be turned back. When you sign in, it hashes what you typed and compares the two.
On Linux the hashes live in /etc/shadow. Only root may read it. The policy for how long a password lasts is kept beside each account. These two Runs look at both.
Who may read the password file?
ls -l /etc/shadowShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The password rules for one account
sudo chage -l internShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The rules every new account gets
grep "^PASS_" /etc/login.defsShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: reading what the terminal printed
| Run | It printed | What it means |
|---|---|---|
| ls -l /etc/shadow | -rw-r----- 1 root shadow | Root may read and write it, the shadow group may read it, nobody else may |
| sudo chage -l intern | Password expires : never | The password lasts until somebody changes it |
| sudo chage -l intern | Maximum number of days ... : 99999 | About 270 years, which means no limit |
| grep "^PASS_" /etc/login.defs | PASS_MAX_DAYS 99999 | New accounts get the same, unless somebody changes it |
The cells students fill in are left blank in this preview.
A common mistake
Warning
Many people think forcing a new password every month makes accounts safer. People then pick a pattern, like Summer2026 and then Autumn2026, which is easy to guess. Change a password when there is a sign it has leaked. Rely on length and two-factor sign-in instead.
Two kinds of proof beat one
A password can still leak. So important accounts ask for a second kind of proof. That is two-factor sign-in.
There are three kinds of proof. Something you know is a password. Something you have is a code from an app on your phone. Something you are is a fingerprint.
Also give each person their own account, with only the privilege their job needs. Then a leaver's account can be closed, and every action has a name on it.
Is a password written in a file?
grep -c StudentLab2026 README.mdShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Going further: a passphrase you can remember
Make up three passphrases of three or four random words each. Do not use one you really use.
Put each through problems from your assignment, with the user name sam. Then add a fourth that fails only because it contains the user name. Write one sentence on why that rule exists.