Way back in 2005, Jesper Johannson and I wrote Protect Your Windows Network. It’s still available, and although its product set is now somewhat dated (Windows XP and Server 2003), much of the practical advice about security policies, social engineering, security dependencies, and how to think about security remains relevant. That’s because we strove to write something more lasting than a simple configuration guide.
On the CD-ROM accompanying the book we included a tool called Passgen. In the book, we recommended that you maintain separate passwords on every local administrator and service account in your enterprise. This is, of course, almost impossible to manage without something to automate it for you. That’s what Passgen does. The tool generates unique passwords based on known input (an identifier and passphrase you define), sets those passwords remotely, and allows you to retrieve them later.
For a while Jesper maintained a web site for the book, running on a server in his house. His ISP changed policies and made it impractical to continue running the site. But because the tool is still so useful, I’ve put a copy in my SkyDrive—look in the “Passgen” folder.
Also, note that I’ve put a new section in the right-side column, “Resources for you.” Here’s where I’ll keep links to bits and pieces that many of you will find relevant and interesting.
Update. A few readers have informed me that the SHA-1 hash printed in the README.DOC doesn’t match the actual hash of passgen.exe. Jesper made a few changes and recompiled the tool. The correct hash is now:
I’ve updated the README file with the new hash. Also, passgen.exe has a digital signature, and you can check its details if you’d like.
Thanks for putting your power point slides up on skydrive :)
The SHA-1 hash doesn't match the one in the Readme doc. The hash that I get is fa19722348e9e0603f24c0ef9fc715010403bcfa
Jack, that's the same hash I'm getting. Steve, is this the right file?
I get the same hash. It's the latest version of the tool from Jesper. I'll follow up with him to see what changes he made after we wrote the appendix for 1.1.
Yes, Jesper made some changes, that's why the hash you see is different than the one in the readme. The .exe also has a digital signature, too. I'll update the blog posting to reflect the changes.
Occasionally, I see a security incident where one of the things that went wrong was that all of the customer's
My favorite passgen is a random kick on keyboard :). Please add Visual Interface to the program if you have some spare time.
Yeah, but what if you ever need to retrieve the password for some reason? ... I doubt Jesper will make further modifications to the tool, he's very much a command-line junkie :)
Over the last few days I blogged several times about Conficker and some of the posts caught quite some
Hi All, We’re seeing an increasing trend globally in the number of infections of the Conficker.B worm.
Until now there is still no ultimate cure for the Conficker.B worm. Any suggestions ?
Letzte Woche habe ich mit Entfernen von Conficker.B eine Kurzanleitung gepostet, wie man Conficker.B
Archie-- we have some guidance on removing Conficker.B.
The Microsoft Malware Protection Center describes the worm's infection vectors and mentions that they've added removal capabilities to the Malicious Software Removal Tool:
The Knowledge Base has an article that describes how to manually clean an infected computer:
How secure is the transmission of the new password, when setting it for a remote machine (passgen -s * -c username -m computername)? I see that it’s not transmitted in clear text, but am curious as to the likelihood of someone who successfully captured the traffic eventually decrypting it.
Thanks for a great tool.