Just when I thought I was winning the security battle, along come the users. Even worse, upper management type users.
I finally convinced the powers that be that 123456789 was most definitely not a secure admin password for the server. And first_name/last_name were not good credentials for user logons. You laugh because you think I’m kidding. I’m not.
I figured the best way to win this battle was to take a preemptive strike. I waited until everyone was out of the office leaving me with no adult supervision. Then I struck. I changed passwords on everything that looked like it needed a new password. Which was everything but the coffee pot (I still can’t get the darned thing to run Linux). And I made them as long and as complex as I could make them. Upper case, lower case, alpha, numeric, special characters, 12-20 characters, the works. I’m not pretending that strong passwords are a cure all for security, but it’s the most obvious (and easiest) place to start. And previously our practices were ridiculous.
I figured a good way to keep track of them was to type up a spreadsheet and store it in a hidden TrueCrypt volume on my hard drive. I encrypted that and protected it with a 20 character alpha numeric special character password. I was pretty pleased with the result figuring it was pretty safe there.
Then the big bosses came back.
So I gave them a printed copy of all the passwords with instructions to keep them locked in a safe place. I explained that they would not need that info unless I were hit by a bus. Two of them took that to heart. Out of three. After all my efforts, I found one of them writing all the usernames, passwords, and URLs in his frikin day planner!!! WTF? Maybe I should open our WAP and broadcast the admin password as the SSID. Or just tape my key to the front door.