I'm wondering how long the root password should be?

I'm running a desktop computer which is connected to the internet almost all the time. Which password length would you recommend? What would you recommend for a high-value server?

Currently, I'm using an random alphanumeric password (a-z, 0-9) with 8 characters, which yields a password strength of about 40 bits. Do you think that is enough?

Regards,

Lotharster

8 character alphanumeric is really the bare minimum IMHO. Including some type of punctuation or special character significantly helps to increase the complexity of a bruteforce as well. It's also very important to have your passwords be reasonably random and not be simple variations of dictionary words, things like 'password1' or 'abcd1234' would be exceptionally poor.

If you are going to allow any kind of remote access (like ssh) I'd also highly recommend that you configure the authentication on the system so that you cannot directly login as root, but instead are required to login as a normal user and su to root.

The passwords I use now for all accounts (not just root) are typically 10-12 characters long. I could not even write down my passwords for you. I create them more with "motions" and "rhythms" on the keyboard. More like playing the piano than typing words. I do have a phrase in my head that helps me remember how to get started typing, but that phrase does not directly come out in the password. I rhythmatically hit the SHIFT key during typing to get an upper/lowercase mix, and I rhythmatically "reach higher" on the keyboard (by this I mean my memorized phrase might make me think of a "t", but I reach higher and get a "6" or "^" on the upper key row instead). You can get some really good random passwords this way.

But I did run into a downside once. I cut my finger and had a bandaid on it. This screwed up my "finger memory" and made it a little tough to get the password entered!

Thanks for your replies, no I have one more question:

What kinds of attacks against my root-password should I guard against?
I've disabled ssh-root login as well as password authentication, so how could a "bad guy" try to hack into my root-account?

Regards,

Lothar

A few more things to consider for a desktop, assuming it is only you or a very limited set of people needing access:

---

Open up one and only one port on your system ... port 22 ... ssh. Firewall out everything else, and configure required services to listen only on the localhost adapter if possible. If you want to access any of these other services you will need to use an ssh tunnel.

Research what they do, and consider using the following options in sshd_config (NOTE: I only allow pubkey authentication, so NO password guessing!)
Consider using an "adaptive firewall". I believe this term was originally coined by Bob Toxen in his book on Linux security, but I may be wrong in crediting him the origins. Basically you spawn a script from hosts.allow that can quickly create tcpwrapper rules or iptables rules to lock out crackers. Bob's implementation of this is named "Cracker Trap". I wrote my own, to meet my personal needs, after recently attending a class taught by Bob.

Attacks attempt to gain a root shell your system. Guessing a root password is one way, but there are other ways to gain access without needing to know the password.

Unfortunately, there are many more ways to crack into a system than I could tell you (I know of a few, but certainly not all). What you've done so far is a great initial step. Make sure you also turn off all unneeded services! Put strong passwords on every account. For accounts that never need direct shell access, turn it off in /etc/password. Here's an example of how this is done for sshd on my system (the shell is specified as "/bin/false"):
After you've done the above, you're in better shape than many people. Now start reading some books and go after closing the more subtle holes.

A good book, that will probably scare the pants off you, is "Hacking Exposed" (5th edition - I think is the current one). There are other books in the "Hacking ... Exposed" series but I have not read them yet. Another good book is the one I mentioned earlier by Bob Toxen - "Real World Linux Security" (2nd edition).

Wow, you guys are all into some major overkill. I just use the password "password" on all my accounts. That really helps me to never forget my password.

more than the length , its the complexity of the password which matters a lot , "22usc336" is better than "abracadabra"

dont forget Special Characters: /()&¤"!@{[]?`´''*"';:

always have the 3 types:
text (lower AND higher case)
numbers
special characters