Getting password length of already existing users.

vickyk · 11-16-2011, 06:31 AM

Hello,

Will it be possible to know the users on a linux box whose password length is lesser than 10 characters ?

Since the passwords get encrypted on creation, I am not sure if /etc/shadow can be used to find this out.

Any help is appreciated. Thank you

unSpawn · 11-16-2011, 06:40 AM

What you could do is check the machine for what the current password policy is, when it was first enforced and when users last changed their password, but note password length (AAAAAAAAAA) is no meaningful indication at all if not combined with password strength (nA#tH@1_1+) checking, remembering used passwords and forcing users to change their password regularly.