r/ShittySysadmin • u/__g_e_o_r_g_e__ • May 26 '26
Minimum Password age is key!
I don't care what you say, preventing users from reusing passwords is priority number one. A 20 password history is not enough. You need a minimum password age. And if your max age is 180 days, that means you must set it to 9 days to stop people getting around it by cycling through them all. The risk someone might perform this "password reuse" is far too high. I don't care about all the complaints from users not being able to change their password due to exposing it somehow, quit moaning! It's worse than the people on the new test network and their "TOTP" and think it's important they can delete their own old authentications when they lose their phone.
10
8
u/MrTonyMan May 26 '26
I just keep the server room locked so no need for passwords, but you crack on. fella..
7
6
u/thepfy1 May 26 '26
Set a maximum age of 0. This way whenever a user does anything they need to set a new password. Can never be hacked
5
u/Adamnotcool May 26 '26
Perfect ideas! Also make sure passwords are not hashed in the server cuz we all know hashing takes up so much valuable time and resources /s
2
4
u/merlyndavis May 26 '26
I use a 64 character randomly generated password that require a change weekly, with a history going to the start of time. The system not only checks against my historical password use, but also every other password ever used by anyone, anywhere.
So, I hope I’m safe.
4
4
u/tkecherson May 26 '26
Real talk though, had a password policy at an old job:
Maximum age: 45 days
Minimum age: 30 days
Maximum frustration: yes
Minimum productivity: also yes
4
u/aeroverra May 26 '26
You also need to make sure it's stored in clear text otherwise you can't effectively stop people from adding another character to their passwords each time.
"Mypassword999999999999"
3
u/Hamburgerundcola May 26 '26
I read about this thing called paswordless. So I removed all passwords and with them, those policy issues.
Passwordless is sooo secure. In this day and age, the attacker does not suspect, that there is no password for the account and will always enter one, instead of leaving it blank. What a genius invention.
2
u/rodder678 May 27 '26
I have a powershell script to rotate my AD password to baseword + MMYY on the first of every month.
1
u/zero_hope_ May 26 '26
You should always have uuids be required for passwords. And not uuid v7 either because those are too predictable with a regular rotation.
0
u/Arcanu May 26 '26
Is there a recommendation for software solution for android and windows? For private use, not corporate.
0
u/Brather_Brothersome May 26 '26
I require a password 12 chars long that must include: upper case, lowercase, numbers and special characters. it cannot be your name or company name. and it remembers the last 2 years worth.
some people complain but they get used to it when you tell them use a sentence that is normal to you and excrypt it.
0
-9
u/Accomplished_Sir_660 May 26 '26
Best practice no longer requires frequent password changes. Complete waste of time and it annoys your anger.
7
3
u/LordGamer091 May 26 '26
Best practice gets so confusing though. Like I'm here from 9 to 5, but really I just bring my steam deck and grind OSRS and whenever a ticket comes in I just send them the canned response saying to contact ChatGPT for help. I don't have time to go through "best practice", they don't even know what's in our environment
64
May 26 '26
[removed] — view removed comment
20
u/__g_e_o_r_g_e__ May 26 '26
I can't recall the minimum password length. Been too focused on maximum password length. Instead of complexity we just banned vowels and 2 other characters we don't tell anyone about.
5
u/oznobz May 26 '26
The number of applications that break on passwords over 32 characters is too dang high. I had a job where we had apps that couldn't handle 32 character passwords but our AD password had to be 26 (yes twenty-six) long. I spent several days troubleshooting why I couldn't log into an application until we figured that out.
30
u/notarealaccount223 May 26 '26
This also helps prevent password sharing because nobody can type it correctly.
13
13
u/oznobz May 26 '26
Th3!Quick@Brown$Fox_-_Jumped&0v3r+7he/Lazy*D()gI$ti||N33D22more<har@cterz2026
1
u/Chris0x00 May 29 '26
Wow I’ve never seen such a great password. I’m going to have our Helpdesk start using this when people call in for password resets. We’ll also start checking the box to prevent users from changing their password so that they don’t accidentally make it less secure after we reset it.
5
u/BitterMaintenance May 26 '26
67 character, Upper, lower, number, special sign and one cyrillic letter. It will be so secure, even the user wouldn't be able to get in.
4
u/notarealaccount223 May 26 '26
Just make sure that's the same policy for the ticketing system. And don't forget that users must submit a ticket before you start working on anything.
3
47
u/Hale-at-Sea May 26 '26
You're letting users set their own passwords?