Passgen tool from my book


Way back in 2005, Jesper Johannson and I wrote Protect Your Windows Network. It’s still available, and although its product set is now somewhat dated (Windows XP and Server 2003), much of the practical advice about security policies, social engineering, security dependencies, and how to think about security remains relevant. That’s because we strove to write something more lasting than a simple configuration guide.

On the CD-ROM accompanying the book we included a tool called Passgen. In the book, we recommended that you maintain separate passwords on every local administrator and service account in your enterprise. This is, of course, almost impossible to manage without something to automate it for you. That’s what Passgen does. The tool generates unique passwords based on known input (an identifier and passphrase you define), sets those passwords remotely, and allows you to retrieve them later.

For a while Jesper maintained a web site for the book, running on a server in his house. His ISP changed policies and made it impractical to continue running the site. But because the tool is still so useful, I’ve put a copy in my SkyDrive—look in the “Passgen” folder.

Also, note that I’ve put a new section in the right-side column, “Resources for you.” Here’s where I’ll keep links to bits and pieces that many of you will find relevant and interesting.

Update. A few readers have informed me that the SHA-1 hash printed in the README.DOC doesn’t match the actual hash of passgen.exe. Jesper made a few changes and recompiled the tool. The correct hash is now:

fa19722348e9e0603f24c0ef9fc715010403bcfa

I’ve updated the README file with the new hash. Also, passgen.exe has a digital signature, and you can check its details if you’d like.

Comments (14)

  1. Anonymous says:

    Letzte Woche habe ich mit Entfernen von Conficker.B eine Kurzanleitung gepostet, wie man Conficker.B

  2. Anonymous says:

    Occasionally, I see a security incident where one of the things that went wrong was that all of the customer’s

  3. Anonymous says:

    Yes, Jesper made some changes, that’s why the hash you see is different than the one in the readme. The .exe also has a digital signature, too. I’ll update the blog posting to reflect the changes.

  4. Anonymous says:

    Hi All, We’re seeing an increasing trend globally in the number of infections of the Conficker.B worm.

  5. Anonymous says:

    Yeah, but what if you ever need to retrieve the password for some reason? … I doubt Jesper will make further modifications to the tool, he’s very much a command-line junkie 🙂

  6. Anonymous says:

    Over the last few days I blogged several times about Conficker and some of the posts caught quite some

  7. Anonymous says:

    Archie– we have some guidance on removing Conficker.B.

    The Microsoft Malware Protection Center describes the worm’s infection vectors and mentions that they’ve added removal capabilities to the Malicious Software Removal Tool:

    The Knowledge Base has an article that describes how to manually clean an infected computer:

  8. Anonymous says:

    I get the same hash. It’s the latest version of the tool from Jesper. I’ll follow up with him to see what changes he made after we wrote the appendix for 1.1.

  9. Brendon says:

    Thanks for putting your power point slides up on skydrive 🙂

  10. jack wilson says:

    The SHA-1 hash doesn’t match the one in the Readme doc. The hash that I get is fa19722348e9e0603f24c0ef9fc715010403bcfa    

    Thanks,

    -jack

  11. Patrick says:

    Jack, that’s the same hash I’m getting. Steve, is this the right file?

  12. Not only Security says:

    My favorite passgen is a random kick on keyboard :). Please add Visual Interface to the program if you have some spare time.

  13. Archie Tolentino says:

    Until now there is still no ultimate cure for the Conficker.B worm. Any suggestions ?

  14. SysAdmin says:

    How secure is the transmission of the new password, when setting it for a remote machine (passgen -s * -c username -m computername)? I see that it’s not transmitted in clear text, but am curious as to the likelihood of someone who successfully captured the traffic eventually decrypting it.

    Thanks for a great tool.