How should I generate a random alphanumeric initial password for new users?

Question

We have to automatically import a large list of users with some data into a running system. For an initial password I want to update the list (csv format at the moment) with a random alphanumeric key (8 digits).

When inserting it with a special routine (which needs a csv file), the password (in this case the alphanumeric key) is stored as a md5 hash.

i.e. I generate a random alphanumeric key:

H2A5D39A -> MD5: 1642fccf791f15d137cf31282af79752

This way I want to create a list where authenticated users can ask me for their initial password (the alphanumeric key).

Do you have a better idea for a "secret" initial password?

How would you create the alphanumeric key in Perl?

P.S.: The "running system", not programmed by us, just allowes alphanumeric passwords (no special chars,...)

Answer 1

How would you create the alphanumeric key in Perl?

join'', map +(0..9,'a'..'z','A'..'Z')[rand(10+26*2)], 1..8

Answer 2

I would probably use pwgen. It is great as it allows easy customization, and has the switch not to use ambiguous characters (think: I, l, 1, O, 0).

for example:

=> pwgen -c -n -B 8 50
shuFak9o peiCh3Oo ohPieng9 Vohh7zuu os3Theep aeV9nuo9 aexeik4B aeChoh9s
uth3eePu baePhu3o aiS3pahn iPie4itu We9zuphi xie3Chi3 yeiRoo7c fai3ITai
aCh9ohco Echuab7v Fu9ahCho Aevae4no Peethai9 AiJio3Pa aeNge9Fo baePh7Uy
Nai7shei eeMoh9en Zeibai4n eGe7yuch Jaek7nai aeZah7sh Chei4ua4 shoo9oG9
iu7Wohho aep7De4U Fong9fo3 AhneeP7U oxae7Yoh ahF4eim3 fahm9Aiw naoNg4ie
Chie4xua jix3Uvot aChei7ai diey4Shi Yur7ee4j eeJeo9ee Bou3ahmu kaeb4Cah
Eh4Eemae oD4phoo9

Answer 3

Anonymous's answer is very good, but, if you need a random string that conforms to some rules (such as at least one uppercase, one lowercase, and one number), you may want to look into String::Random.

Answer 4

Another module to consider is Data::Random

Answer 5

I just completed a review of the 12 modules on CPAN that can be used to generate random passwords:

http://blogs.perl.org/users/neilb/2011/08/random-password-generation.html

In short: if you want a pronounceable password, look at Crypt::YAPassGen, otherwise go for App::Genpass.

App::Genpass avoids confusable characters and gives you better control (and defaults) than Data::Random or String::Random