Is It a Best/Recommended Practice to Not Allow Desktop Clipboard Pastes for Password Fields on a Website?

Problem scenario
You think a website field for a password should allow a password to be pasted in. This could make the users not copy the password. Some hackers exploit memory/RAM. Should you avoid allowing a password to be pasted in?

Solution
Traditionally confirmation password fields did not allow pasting (with control-v) from the clipboard. Now NIST is saying you can do this: https://pages.nist.gov/800-63-FAQ/

Some people think it is not ideal to have sensitive information in RAM. It is not clear. If you make the field impossible to paste, and declare it, the user may not copy the password. But this would violate modern NIST standards.

You may want to read this too: https://www.auditboard.com/blog/nist-password-guidelines/

How Are Backoff Strategies (with Client Retries) Helpful?

Question
Sometimes a client attempts to connect to or use an application. Sometimes a Kubernetes Pod is being created and tries to pull down an image. Sometimes a network device tries to establish a connection to an endpoint. These attempts can initially fail. Retries can be attempted in rapid succession. To mitigate excessive attempts in a short amount of time (to not waste resources or cause a denial-of-service attack), a backoff strategy will be implemented.

A backoff strategy is one where a program or algorithm may try to pause after initial failed attempts, to eventually try again. Ultimately the goal is to connect to another service or use a file (or something similar). But if the other service was in use and constrained (e.g., via concurrency control), the client attempts may fail.

It seems like aggressively and persistently retrying to use the resource (e.g., a file) would be the best option after an initial failure. Why would backoff strategies be used rather than repeated simple, fixed-time intervals?

Answer
For files: Round robin distribution for multiple clients, processes or applications is achievable over time provided that simultaneous attempts at accessing a file with strict locking are avoided. Slowing the rate after a certain number of failures is beneficial to both the overall success of multiple processes and the security of the entire software system.

Concurrency control with files, variables in messaging systems, or atomic values in data stores often involve decentralized components. Race conditions involve two or more clients trying to use a resource at the same time. To backoff attempting excessive utilization of a file (e.g., two or more processes trying to modify a file) or variable that is not available, a random amount of time may be used to pause the subsequent attempt. Successive backoffs, as part of a strategy to successfully modify or write data, may involve durations that successively become increasing. Excessive failed attempts can create bandwidth congestion or unnecessary CPU or RAM utilization. Random durations of retries can prevent problems with inadvertently simultaneous attempts.

Backoff algorithms (with variable time factors that increase each successive attempt) can prevent denial of service attacks as compromised systems cannot make too many requests in a short duration. A client's thread (or process) that attempts to access data may need to invoke a sleep function (a common feature of many programming languages) to ensure time lapses between attempts.

Network traffic routing also involves a decentralized pair of devices (a source and destination). If there are collisions with packets in a network, many routing algorithms will have a variable amount of time before a packet is transmitted across the network again. Collision avoidance along paths can be better achieved with a backoff strategy. See [1] for more information.

Upstream throttling or load shedding are deliberate actions designed to prevent a denial-of-service. The benefit of having some service at the price of reduced rate/capacity can be a design tradeoff that systems architects are willing to accept. Synchronization of resource utilization could be an alternative to backoff strategies (by avoiding the scenarios where they are necessary). Usually this scheduling strategy for performance tuning would apply to routine processing of batch jobs or nightly backups. By using different schedules for processes that try to connect to a server or use the same file, you can avoid the race conditions or getting close to maximum bandwidth utilization at single time of the day.

[1] https://en.wikipedia.org/wiki/Exponential_backoff#Collision_avoidance

To read about backoffs with Kubernetes using different images, see these four links:

https://www.tutorialworks.com/kubernetes-imagepullbackoff/
https://stackoverflow.com/questions/34848422/how-can-i-debug-imagepullbackoff

https://blog.ediri.io/kubernetes-imagepullbackoff

https://foxutech.medium.com/kubernetes-imagepullbackoff-troubleshooting-with-examples-6c278c3bbb43

How Do You Install the Putty Utility on a Linux Server?

Problem scenario
You want to run the puttygen command on a Linux server. (You tried yum and dnf commands to install putty, but they failed.) What do you do?

Solution
Prerequisites

i. These directions assume you have installed the C compiler. If you need assistance, see How Do You Install a C Compiler on Linux?
ii. These directions also assume you have the GTK library installed. For a CentOS/RHEL/Fedora server, run this: sudo yum -y install gtk2-devel.
iii. This assumes that make is installed. If you need assistance see How Do You Install the make Utility on Any Type of Linux?

Procedures
Run this script:

version=0.74
curl -L https://the.earth.li/~sgtatham/putty/latest/putty-$version.tar.gz > /tmp/putty-$version.tar.gz
cp /tmp/putty-$version.tar.gz /bin/
cd /bin
tar -zxvf putty-$version.tar.gz
cd putty-$version
./configure
make
make install
echo ""
echo "Script is complete. Below will check the version for default CentOS/RHEL/Fedora installations…"
echo ""
/usr/local/bin/puttygen --version

Is It a Best/Recommended Practice to Enforce Complex Passwords?

Problem scenario
You are modifying /etc/security/pwquality.conf. Is it a recommended practice to have no or few repeating characters with different classes of characters including lowercase, uppercase, numbers and special characters?

Solution
It can be counter productive to have very strong password requirements according to the NIST (https://pages.nist.gov/800-63-FAQ/).

If you are using Linux or Unix, NIST does suggest you use a crack library dictionary (per A-B10 from https://pages.nist.gov/800-63-FAQ/). Often these are used by default.

You may want to read this: https://www.sans.org/blog/nist-has-spoken-death-to-complexity-long-live-the-passphrase/

The FBI says "Make sure your password is as long as the system will allow." (This was taken from https://www.fbi.gov/contact-us/field-offices/phoenix/news/press-releases/fbi-tech-tuesday-strong-passphrases-and-account-protection.)

Some sources recommend you have complex passwords: https://www.sseinc.com/blog/cmmc-password-requirements/

Is It a Best/Recommended Practice to Not Use “Make Visible” the Password when Entering It?

Problem scenario
You think that the users should not click the "make visible" option when entering a password. As an I.T. professional, you are not sure if this should be used or not. You read and think that it should not be used. Is it recommended that you have a practice of not letting the users make the password visible?

Solution
It is not clear. The National Institute for Standards and Technology now recommend you use it (according to
https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/ ). Why? Users are given incentive to create shorter more guessable passwords when they cannot type it in. Traditionally it was said that passwords should not be written down or saved elsewhere. Password managers are now common. Visibility enables complex passwords. Canonically the policy was that if someone was shoulder surfing, an invisible password (with "*" or dots) would be more secure.

Is It a Recommended/Best Practice to Use Email as a Component in Two Factor Authentication?

Problem scenario
You want to implement a secure protocol for authentication. You want there to be a password and a second factor of authentication. Can an email (being in possession of an inbox) be a factor in MFA?

Answer
Maybe.

No, according to NIST: https://pages.nist.gov/800-63-FAQ/
But many companies do use email as a factor in multi-factor authentication.

How Do You Troubleshoot a quotacheck Command Failure with “Cannot guess format from filename…Please specify format on commandline”?

One of the following apply to your situation:

Problem scenario #1
You are running a quotacheck command. You get this error:

quotacheck: Cannot guess format from filename on /dev/mapper/ubuntu--vg-ubuntu--lv. Please specify format on commandline.
quotacheck: Cannot find filesystem to check or filesystem not mounted with quota option.

What should you do?

or
Problem scenario #2
You try to run an edquota command, but you get "Cannot find any quota file to work on. No file systems with quota detected." What should you do?

or

Problem scenario #3
You get an error like this:

quotacheck: Cannot guess format from filename on foobar. Please specify format on commandline.
quotacheck: Cannot find filesystem to check or filesystem not mounted with quota option.

What should you do?

Possible Solution #1 (for a Red Hat distribution of Linux)

  1. Remove the aquota.group and aquota.user files
  2. Run this (but change "vfsv1" to "vfsv0" if you are using a 32 bit OS):
sudo quotacheck -F vfsv1 -avum

This solution was adapted from https://talk.plesk.com/threads/hard-diskquota-install-error.258095/

Possible Solution #2 (for a non Red Hat distribution of Linux)
According to Red Hat documentation, this probably would not help a Red Hat derivative Linux system. Below could help a non-Red Hat Linux system.

Backup the /etc/fstab file to (.bak in some accessible directory). Keep the original backup in case there is a problem.

Update the /etc/fstab file.

Is the word "quota" near the "grpquota" word on the line for the file system you want to have a quota enforced?

Here is a version of an incorrect /etc/fstab file that will cause the problem:

/dev/disk/by-id/dm-uuid-LVM-abcd1234 / ext4 defaults,grpquota 0 0
# /boot was on /dev/sda2 during curtin installation
/dev/disk/by-uuid/987654321 /boot ext4 defaults 0 0

Here is a correct version of /etc/fstab:

/dev/disk/by-id/dm-uuid-LVM-abcd1234 / ext4 defaults,quota,grpquota 0 0
# /boot was on /dev/sda2 during curtin installation
/dev/disk/by-uuid/987654321 /boot ext4 defaults 0 0

Remount the relevant mount point (with a sudo mount -o remount /relevant/mount/point) or reboot after your /etc/fstab has been corrected.

Possible Solution #3
See these postings:

https://www.howtoforge.com/community/threads/quotacheck-cannot-find-filesystem-to-check.25954/
https://blog.naver.com/syseoz/220458453446

How Do You Get quota Commands to Return Current Data?

Problem scenario
You run a quota -au or quota -ag command to see the latest/up-to-date statistics. You see the number of blocks or inodes is discrepant with what is currently on your system for the user or group. You tried rebooting, but that did not help. How do you get the use blocks and used inodes to be updated with a quota command?

Possible Solution #1
Run a command like this:

sudo quotacheck -vug

If you think something is still misleading/inaccurate, have you enabled quotas? Can you run this next command?

sudo quotaon -ap

The above command lists if quotas have been enabled. The quotaon command is necessary to enable quotas -- the repquota command may show statistics that look promising, but no quotas could be enabled. Grace periods could be counting down or be completely expired.

quotaon -g /file/system # this will enable groups on the "/file/system" path.
quotaon -au # this will enable all users' quotas

Possible Solution #2
If the user has not created any files, the user may not appear in a "repquota" command. If the user can create some files, or you can create files and change the ownership to the user, that could allow the user to be seen in the output of a repquota command.

Are the files in the partition with the quota? If not, that could explain the potential inaccuracy you are seeing.

How Do You Set a Date-Time Value with a Default Year in Python?

Problem scenario
You are printing out some dates with a Python program. You are using the datetime module and the strptime method. The year is always defaulting to 1900 because the log entries have no year designated in them. How do you seed the dates with a specific year of your choice?

Solution
Here is an example of how to seed the dates with the year 2021 (but it assumes you have a file name auth.log with dates without years in it):

import datetime
from datetime import datetime, timezone
log_reader = open('auth.log', 'r')
for line in log_reader:
    dt_of_log = datetime.strptime('2021 ' + line[:6], '%Y %b %d')
    print(dt_of_log)

Is It a Best/Recommended Practice to Rotate Passwords?

Problem scenario
You know hackers and malicious social engineers love passwords. You are considering enforcing password rotations temporally (as a systems administrator, security consultant, or I.T. manager). You want planned periodic password changes to happen in a mandatory way. In theory if a password was once lost, changing it mitigates the damage. This is intuitive and consistent with a variety of sources. Many OSes and LDAPs facilitate built-in password expirations based on time intervals. Is it a recommended practice to force passwords to be changed (or expire) based on an amount of time?

Answer
Maybe.

Here are sources that are in favor of password rotation (because they say it is important or something similar):

… infrequent password rotation increases the risk that cyberattacks on vulnerable IoT devices…

https://venturebeat.com/2022/02/18/password-rotation-can-make-or-break-your-security-posture/

Password rotation should be implemented across every account, system, networked hardware, IoT device, application, service, etc. Passwords should be unique, never reused or repeated, and randomized on a scheduled basis, upon check-in, or in response to specific threat or vulnerability.

https://www.beyondtrust.com/resources/glossary/password-rotation

Page 46 of this PDF (although that page says "36") indicates passwords should expire.

Some companies recommend having strong passwords but recommend changing just one character every time you rotate the password. This bullet is in both sections as it has an ambivalence toward the enterprise's policy itself.


Here are sources that advise against password rotation (or at least mention that there are disadvantages to doing it):

https://www.sans.org/blog/the-debate-around-password-rotation-policies/
https://securityboulevard.com/2020/03/the-pros-and-cons-of-password-rotation-policies/
https://spycloud.com/2020-prediction-the-death-of-the-password-rotation-policy/

https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes

https://duo.com/decipher/microsoft-will-no-longer-recommend-forcing-periodic-password-changes

Some companies recommend having strong passwords but recommend changing just one character every time you rotate the password. This link is in both sections as it has an ambivalence toward the enterprise's policy itself: https://www.strongdm.com/blog/password-policy-best-practices

FFR
/etc/login.defs is a file that on Linux/Unix machines facilitates expiration of passwords. Some people may find this file to be obsolete or a legacy of an older era.