There is a cause why no one else is nervous about your menace mannequin. RFC 4086 (ietf.org) says {that a} password with at the very least 29 bits of entropy is safe in opposition to brute-force assault over a community:
To have a one-in-a-thousand likelihood of guessing the password in 500,000
tries implies a universe of at the very least 500,000,000 passwords, or about
2^29. Thus, 29 bits of randomness are wanted. This may in all probability be
achieved by utilizing the US DoD-recommended inputs for password
era, because it has 8 inputs that in all probability common over 5 bits of
randomness every (see part 7.1). Utilizing a listing of 1,000 phrases, the
password may very well be expressed as a three-word phrase (1,000,000,000
potentialities). Through the use of case-insensitive letters and digits, six
characters would suffice ((26+10)^6 = 2,176,782,336 potentialities).
Does your admin password meet that commonplace? If not, why not? In that case, how do you envision a profitable assault, particularly in case your file server is barely accessible from the LAN?
As an experiment, I ran a script to simulate a brute-force assault on the SMB sharing service on localhost:
SECONDS=0 for i in {1..100} do mount_smbfs //:@localhost /tmp executed echo $SECONDS seconds elapsed The output was:
mount_smbfs: server rejected the connection: Authentication error mount_smbfs: server rejected the connection: Authentication error ... mount_smbfs: server rejected the connection: Authentication error 48 seconds elapsed That is 100 connection makes an attempt in 48 seconds, or about 2 makes an attempt per second. An element of 12 sooner than the hypothetical assault described in RFC 4086 in 2005, true, however this was an assault on the loopback tackle, not likely a community assault.
The OP says that SMB on Home windows is capped at 0.5 makes an attempt per second, an element of 4 slower than this simulation. I am going to take his phrase for that.
My conclusion is that, 20 years later, it will be affordable to lift the really useful minimal password entropy within the RFC by 4 bits, from 29 to 33, which might improve the anticipated variety of required makes an attempt for a profitable brute-force assault by an element of 16. In follow, there is no cause to not use passwords a lot stronger than that anyway.
