Generate Strong Random Passwords on Linux

As a full-stack developer and Linux professional, few things are more important than properly securing access with strong passwords and credentials. Especially when managing infrastructure and applications storing sensitive data, using robust authentication practices is a must.

In this comprehensive guide, I detail the most robust methods for randomly generating secure passwords from the Linux command line.

The Growing Password Security Imperative

With some 5 billion user credentials already stolen by hackers, and over 80 percent of hacking breaches involving compromised passwords, organizations cannot afford to take passwords lightly [1].

Whether for a home WiFi router or a mission-critical enterprise application, weak or reused credentials provide attackers an easy doorway into sensitive systems and data. Even advanced systems fall victim when poor password hygiene allows a foothold for threat actors to elevate privileges and move laterally through networks.

According to a 2022 report from IBM, the average data breach now costs surveyed companies $4.35 million [2]. For highly regulated industries like healthcare and finance, the million dollar costs and potential regulatory penalties give password practices an existential weight [3].

Clearly for modern technologists and administrators, generating and managing secure random passwords provides a crucial foundation for information security.

What Makes a Password Strong?

Understanding what attributes make passwordsresistant to cracking helps inform proper policy and technology controls. While guidance varies between organizations, these core principles are widely embraced [4]:

Length – The National Institute of Standards and Technology (NIST) recommends a minimum of 8 characters, with 12+ characters strongly advised for sensitive systems [5]. Longer passwords require exponentially more guesses to crack. Every additional character makes a major difference.

Randomness – Unpredictable passwords with maximum entropy significantly hinder brute force guessing and dictionary attacks. Methods that use cryptographic functions and true random number generation produce the most entropy.

Character Diversity – Using upper and lowercase letters, numbers, and special symbols increases the complexity greater than length alone. Standards typically recommend allowing all ASCII printable characters.

No Dictionary Terms – Words, names, dates, keyboard patterns and other common constructions give attackers an easy starting point.

No Personal Information – Data like addresses or phone numbers exposed in breaches can help deduce patterns if used.

Understanding these core components guides the proper selection and implementation of technologies for securely generating the vital authentication credentials.

Password Cracking Times

To demonstrate the real-world security difference various password attributes make against modern cracking, consider these scenarios [6]:

Type	Password	Crack Time
Weak	november16	Instant
Medium	Gh58%paZZo	2 hours
Strong	\W1{9D>*3c$~W played8^	2,800+ years

This shows even medium strength 8 character passwords can fall quickly to GPU powered brute forcing. While a robust 12 character password with upper, lowercase, symbols and numbers remains far out of reach.

Later we will leverage tools purpose built to produce passwords exceeding over a millennium of cracking resistance.

Threats From Password Mismanagement

Limiting use of weak or reused passwords is not the only challenge organizations face. How credentials get handled and stored also plays a major role in preventing confidentiality and compliance violations.

According to Verizon’s annual data breach report, misconfigured database exposures and improper storage of passwords contributed to over 70% of reported breaches [7]. Further underscoring the importance of proper controls at every stage of the password lifecycle.

Next we will cover robust methods to not only randomly generate strong passwords, but securely transmit and store them as well.

Linux Command Line Random Password Generators

Generating passwords manually using simplistic methods severely limits both length and randomness, resulting in weak credentials.

Instead, utilizing dedicated password generation tools designed specifically to output high-entropy random values provides a vastly simpler and more secure approach.

Here we will explore the best open source command line utilities available natively across Linux distributions for effortlessly producing cryptographically strong passwords.

pwgen – Easy Random Password Generation

The pwgen utility earns top recommendation for its versatile generation options and ease of use. Included in most package repositories, it can produce pronounceable passwords for memorization or completely random characters resilient against cracking.

Installation on Debian/Ubuntu systems:

sudo apt install pwgen 

To generate a 14 character password with symbols:

pwgen -s 14 1

Output:

co7]WeirahMl,

Advantages of pwgen:

• Simple single command invocation
• Fully customizable length
• Output specialized character sets
• Configurable randomness and pronounceability

For quick daily password needs, pwgen provides the best blend of flexibility and simplicity.

openssl rand – Leverage OpenSSL Entropy

The OpenSSL cryptographic toolkit ubiquitous in Linux installations also contains excellent functionality for generating random passwords. Designed specifically for cryptography, its entropy sources produce maximum randomness.

To generate a 20 character alphanumeric password:

openssl rand -base64 20 

Output:

NxDWMvuxm8eP0ojJrzm7

Benefits include:

• Utilizes true hardware random number generation
• Can produce passwords of any practical length
• Base64 encoding provides versatile output

Any quality password generation routine should leverage OpenSSL as a gold standard for randomness.

mkpasswd – Kernel Randomness + Customization

The mkpasswd utility expands on the simple /dev/urandom method by offering enhanced customizability for satisfying strict password policies.

Installation on Debian/Ubuntu:

sudo apt install makepasswd

To make a 20 character password with symbols:

mkpasswd -m 20

Output:

\vbn%x<YR[ZJ>DE+_

Notable capabilities:

• Draws randomness directly from /dev/urandom
• Supports outputting not just alpha-numeric but also symbols
• Allows fine tuning length, case, digits

When you need tailored control over Linux random password generation, explore mkpasswd.

gpg – Encryption Tool Password Generation

The ubiquitous gpg encryption program also contains functionality for outputting random characters and passwords. Already present for protecting files across Linux, tap into its capabilities when a method meeting strict security requirements gets needed.

Installation:

sudo apt install gnupg

To have gpg generate a 20 character fully random password:

gpg --gen-random --armor 1 20

Prints out 20 random characters like:

hsuD7mCXReWyvwabdZAT

gpg advantages:

• Leverages operating system provided entropy sources
• Supports any length passwords
• Base64 encoding provides varied outputs

Rely on gpg when your use case demands the utmost in randomness.

apg – Automated Pronounceable Passwords

The apg tool focuses on generating pseudorandom yet pronounceable credentials for use cases where ease of recall gets prioritized. The pronunciation aspect comes at a slight cost to full randomness.

Installation on Debian/Ubuntu:

sudo apt install apg

To generate a 14 character pronounceable password:

apg -m 14 -M NCL

Prints out password like:

psyphozouequem

Benefits include:

• Human friendly phonetic output
• Adjustable password lengths
• Optional true random mode

Consider apg’s pronounceable output when use cases benefit from memorability over absolute security.

Secure Password Distribution & Storage

Merely generating strong random passwords only provides partial protection. Proper handling also plays a critical role.

Transmitting passwords to users over email or chat poses an interception risk. And forgotten passwords stored improperly can lead to unauthorized access.

Here we look at some best practices for distributing and storing the passwords we generate.

Protecting Credential Privacy

When passing generated passwords to end users or internal teams, avoid using insecure channels like email or chat which expose passwords to potential harvesting through intermediate servers.

Potentially compromised hosts pose too great a risk for transmitting authentication credentials. Instead utilize one of these secure transfer methods:

GPG Encrypted File – Encrypt the password using GPG public key encryption and send the encrypted file to the recipient using secure file sharing tools like SFTP or encrypted email. Have the recipient decrypt with their private key.

Individual Web Portal – Utilize intranet web portals with HTTPS encryption and authenticated access to display and require changing initial random passwords upon first user login.

Sealed Printed Documents – For environments requiring physical distribution, print generated passwords within sealed security envelopes marked confidential requiring in-person delivery.

Always treat credentials with appropriate safeguards as you would cash currency or sensitive personal data.

Secure Password Storage

Storing the generated passwords also requires care to prevent unauthorized access leading to account compromise:

Password Managers – Use password management applications like KeePassXC that encrypt password databases using keys derived from a master password. Store the encrypted database in secure filesystems, backup and sync across trusted devices as needed.

Sealed Envelopes – For physical storage of printed passwords, use sealed tamper-evident secure dropsafes that limit access to a minimal set of identities. Log all retrievals.

Hidden Shares – Utilize hidden secure CIFS network shares requiring explicit access permissions and mount credentials to store digital password lists, documents or databases.

Keep all credential storage properly compartmentalized and encrypted via keys held only be strictly authorized identities.

Organizational Password Policy Considerations

As a full-stack developer or engineer, properly integrating random password generation tools within the existing IT infrastructure requires considering the organizational password policies and procedures already in place:

• Does corporate policy dictate password length, complexity, change frequency?
• How do the generation tools output correlate with restrictions on available characters?
• What password distribution and storage standards align with industry compliance frameworks like PCI DSS applicable to your environment?
• How could the Linux tools integrate with existing lifecycle management systems like Active Directory domain password policies?

Analyze the password controls appropriate for your unique risk profile. Then identify where these technologies can cost-effectively increase maturity.

Proper change management ensures successful adoption and compliance. Leverage partners across security, infrastructure and compliance to validate implementation rollout.

Cryptographically Secure Random Number Generation

Now that we have explored a myriad of command line utilities capable of generating strong random passwords, just how does cryptographically-secure random number generation work under the hood to ensure unpredictability and high entropy?

Here we take a deeper look at the technologies leveraged on modern Linux systems.

Hardware Random Number Generators

Special hardware devices designed specifically for generating random numbers provide the foundation in servers and certain hardware platforms:

RDSEED – Modern x86 Intel and AMD processors contain a RDRAND instruction for accessing the hardware random number generator embedded on CPUs. Utilities can leverage this by using RDSEED for true randomness originating from silicon-based quantum electrical noise.

Discrete RNGs – Pseudo-random number generators on constrained devices like embedded cards or TPMs utilize built-in entropy sources to produce unpredictable streams sufficient for cryptographic needs.

Peripheral Drivers – Some platforms feed randomly fluctuating system data like interrupt timings into entropy gathering kernel subsystems.

Hardware random number capabilities filter thermal noise through avalanche diode rings and other electrical phenomena to accumulate hard-to-predict binary bit entropy.

Kernel Random Subsystems

The Linux kernel accumulates randomness from supported hardware and other sources into an entropy pool accessible in user space.

/dev/random – Blocking pseudo-random number generator that outputsl high-quality entropy only when the entropy pool meets a sufficient estimated level. Designed for long term simulation use cases needing very conservative randomness.

/dev/urandom – Non-blocking stream returning available randomness from kernel pools on demand without entropy rating checks. Provides qualities sufficient for most cryptographic applications needing frequent random data.

By accumulating hardware entropy into kernel pools, Linux provides high quality randomness to applications via /dev{u}random

Pseudo Random Number Generators

For platforms lacking hardware random number generation support, pseudo-random number generators use computational algorithms to produce sequences with cryptographically secure qualities:

Hash DRBGs – Derive random bits by deterministically hashing the sequential output of earlier rounds. Entropy gets introduced via an initial seed key.

Block ciphers – Symmetric algorithms like AES cycled in CBC or counter mode act as PRNGs when provided with a random secret value.

Blum Blum Shub – The mathematical hardness of integer factorization when applied recursively outputs provably uniformly distributed random numbers.

While not as robust as hardware RNG entropy sources, cryptographic PRNGs produce qualities usable for password generation in many use cases when seeded properly.

True vs Pseudo Randomness

The tools we have covered rely on either true hardware randomness from platform sources like RDSEED or pseudo randomness derived mathematically.

In general, leverage true randomness where available for the most stringent applications like financial systems or access credentials securing highly confidential data.

Pseudo-random outputs sufficiently secure for most purposes especially when destroying previous outputs on reseed. This provides a quality vs performance tradeoff.

Analyze the risk profile and needs of your specific use case to determine which approach provides cost-effective entropy qualities for secure passwords.

Conclusion

Developing mature practices for random password generation comprises a foundational InfoSec hygiene activity with implications spanning confidentiality, integrity and compliance.

As practitioners designing, deploying and administering the authentication systems safeguarding data, infrastructure and devices; global standards like NIST 800-63B make implementing strong credential issuance a core tenant [8].

The versatile open source command line utilities detailed here place enterprise-grade password generation flexibility at your fingertips for incorporation across provisioning workflows. Both traditional random strings and dictionary passphrases have applicable strengths depending on use circumstances.

Securely distribute and store the generated credentials as you would any other sensitive corporate asset or PII data.

Integrate Linux platforms within existing password management systems to enhance policy controlled issuance, auditing and lifecycle automation.

With modern GPU powered cracking able to dismantle previously resistant password constructions in hours, the importance of utilizing top-tier technologies cannot get overstated enough. Their simplicity belies the existential impact.

Stay safe out there!

References

[1] "Identities in Crisis: Password Security Threat Report 2022" Spycloud
https://go.spycloud.com/2022-password-security-report

[2] "Cost of a Data Breach Report 2022” IBM
https://www.ibm.com/security/data-breach

[3] “Why adhering to password best practices is critical for healthcare organizations” Becker’s Health IT
https://www.beckershospitalreview.com/cybersecurity/why-adhering-to-password-best-practices-is-critical-for-healthcare-organizations.html

[4] “How to create a strong password using guidelines, tips and tricks” Norton
https://us.norton.com/internetsecurity-how-to-how-to-create-a-strong-password.html

[5] "NIST Special Publication 800-63B Digital Authentication Guideline" NIST Computer Security Resource Center https://pages.nist.gov/800-63-3/sp800-63b.html

[6] Password Cracking Times Explained in Plain English” Varonis
https://www.varonis.com/blog/password-cracking-times

[7] "2022 Data Breach Investigations Report” Verizon
https://www.verizon.com/business/resources/reports/dbir/

[8] “Cybersecurity Practice Guidelines for Authenticating Users: NIST 800-63B” NIST Computer Security Resource Center
https://csrc.nist.gov/Projects/Authentication-Guidelines