in the last few years, i have not heard of any systems being cracked by force passwd attacks. Shadow passwd's already provide alot more security than the old-style passwd files. Still, i think a good admin should run john or crack on the shadow's, just to weed out people doing stuff like "l/p: jspams/jspams2233". passwd sniffing seems to be the greatest problem. pop is evil, telnet is evil, http is evil. OpenSSH to bind them all. -- ======================================================================== Rocky McGaugh Atipa Linux Solutions Linux Systems Engineer www.atipa.com rocky@smluc.org rmcgaugh@atipa.com ======================================================================== -- To unsubscribe send e-mail to suse-linux-e-unsubscribe@suse.com For additional commands send e-mail to suse-linux-e-help@suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/