Self Service Password Reset

[plexer]

Ok guys here's the first attempt at this I'm hopeing some of you may like to take it and improve it and share the results.

 

In the zip file are 2 folders and the database at the moment it is an access database but could easily be moved to a mysql I suppose.

 

The register folder needs to be extracted to a web directory with integrated authentication and the reset one to a web folder with anonymous access.

 

The database can be put anywhere and the asp files modified to reflect this.

 

The user running the reset web page has to have correct access to be able to reset passwords and I'm not sure what these need to be as mine seems to work at the moment.

 

The code is a bit messy but seems to work. The answers to questions 1 & 2 are md5 encoded in the database but the 3rd one is left as clear text as it could form the basis of a helpdesk check that a person is who they say they are.

 

At the moment the password that theirs is changed too is hard coded but this could be easily changed to a form to allow them to pick their own.

 

There is no styling on the forms and html at the moment again I'm hoping someone that's better than me at pretty html could help out.

 

I'd also like to improve the questions so that they can't answer the same question 3 times which they can at the moment but that's for version 2 maybe.

 

If anyone tries it and has problems let me know.

 

Cheers,

 

Ben

reset.zip

[plexer]

31 views and not comments from anyone?

 

Ben

[webman]

It's only been downloaded twice

 

I had a look at the code and the DB structure. It looks good, seems as though it will provide some good results... haven't had time to test the actual scripts yet though.

[russdev]

will have look at it end of this week

 

russ

[GrumbleDook]

Passed onto my NM for a look.

[Shiny_Guru]

Hi,

 

I like the idea, although childrens inability to be original means that we may have to think carefully about the questions or they could become guessable.

 

A cursory look at the code shows that you are passing the user name in the form and trusting that to be correct, where I can see some of our more able hackers spoofing the form data (I have one - thankfully on the side of the angels - who would do it just for the challenge)

 

Given that you are trusting ASP to return the user and then submit that as a hidden field, could you not make that calculation in the register_user.asp so that it need not be passed?

 

Also, it would be nice to have the student need to bring something physical to the equation. If you made the system generate one of the answers perhaps as a long random number you could have the confirmation screen display it as a bar code to be printed and used as an unlock ticket - your reset terminal would need a bar code reader but it would mean that physical theft would be involved to steal someones password which is a reasonable deterent.

 

You could force a re-registration after every unlock to make the key one time only which would also enhance the security.

 

I will try & install it on a machine somewhere that serves ASP and play with the functionality later so these are only initial thoughts.

 

Keep up the good work

[plexer]

Hi SG,

 

All good ideas. Yes the form responses could be spoofed.

 

I will look into maybe passing them as session variables or something instead and changing register_user.asp so it gets the username there instead.

 

The physical ticket idea is good but if it was something that was printed then they could lose it. Maybe a confimation code that they have to write down.

 

I suppose could use another field in the database to store if they had unlocked and then make them re register next time they logged in.

 

Cheers,

 

Ben

[fooby]

Is there a way to load this at logon somehow? Because if they can't logon, how can they reset their password?

 

Just a thought

[webman]

Is there a way to load this at logon somehow? Because if they can't logon, how can they reset their password?

 

Just a thought

 

Create a locked-down passwordless account called "resetpassword" who's shell is a web browser that loads that page.

[MrDylan]

If they're on XP why can't they just right click on 'Change Password' button of the Ctrl-Alt-Del menu?

 

Though I actually have that button disabled though GP.

[webman]

If they're on XP why can't they just right click on 'Change Password' button of the Ctrl-Alt-Del menu?

 

Because you can only get that button once you have logged in. And to log in you need your current password - hence this self-service password reset for if it has been compromised/forgotten ...

[MrDylan]

If they're on XP why can't they just right click on 'Change Password' button of the Ctrl-Alt-Del menu?

 

Because you can only get that button once you have logged in. And to log in you need your current password - hence this self-service password reset for if it has been compromised/forgotten ...

 

ahh right, thanks.

[Irazmus]

Plexer,

 

Very nice idea, although I have a feeling that unless we force the kids to register their answers to the questions, some will never bother, defeating the object somewhat.

 

To force this, I've got a login script that calls register.html (asp removed to prevent form spoofing as pointed out by Shiny_Guru, username now retrieved in register_user.asp) in IE's kiosk mode.

register_user.asp removes the user login script once the details are stored.

This works fine if the user is an admin who has permissions to modify AD, but if it's a normal user it fails due to insufficient privileges.

 

I'm new to asp so I'm pretty much winging this, but I think I need to stop impersonating the current authenticted user while running the AD code, for which I've found this code:

// Stop impersonation
WindowsImpersonationContext ctx = WindowsIdentity.Impersonate(IntPtr.Zero);
try 
{
 // Thread is now running under the process identity.
 // Any resource access here uses the process identity.
// Remove logon script from user
Dim oUser
Set oUser = GetObject("WinNT://domain.sch.uk/" & strusername & "")
oUser.LoginScript =  ""
oUser.SetInfo
Set oUser = Nothing

}
finally 
{
 // Resume impersonation
 ctx.Undo(); 
}

Trouble is, I keep getting an error:

Microsoft VBScript compilation  error '800a0401'

Expected end of statement

/register/register_user.asp, line 85

WindowsImpersonationContext ctx = WindowsIdentity.Impersonate(IntPtr.Zero);
--------------------------------------------------------------------------^

Googling the error code suggested looking for missing & or , but as I'm not familiar with asp's syntax, i'm a little stuck as to how to fix it.

 

Can anyone point out what's missing, or if I'm even on the right track?

 

I've attached my modified (non-working) version incase that's of help.

sspr_broken_.zip

[plexer]

Irazmus: Excellent work there on the css etc... thats exactly what I was hoping someone would do to make it look pretty.

 

Rather that using a logon script could we just set their homepage to an asp page that searches the db for their username, if it exists they have filled it in and they get redirected to google or wherever. If they don't exist they are then redirected to the sign up page?

 

Ben

[Irazmus]

Glad you like the redesign

 

Yes we could do it that way, infact I've just modified register.asp to check if the current username is in the database, and to skip the reg page and redirect to Google if it is

I'd still like to find exactly what I was missing though, as I can see some situations where a logon script would be better

[plexer]

Irazmus: From what I can remember and I do need to revisit the code is that I think the remaingin 2 things that need doing to make it usable is too not allow null answers and I have a really good javascript at work for that and to also not allow them to pick the same 3 questions to answer.

 

What also might need to be considered is to have the reset user account auto logoff after a specified amount of time just to stop someone being logged in as it and trying to hack or trying to tie up a workstation.

 

Cheers,

 

Ben

[plexer]

http://www.javascript-coder.com/html-form/javascript-form-validation.phtml is the form validator I've been using.

 

Ben

[plexer]

Ok just changed register.html to need to have answers filled in and to not allow you to pick the same question more than once using the javascript validator.

 

I wrote the question checking as seperate functions i.e check question 1 and 2, 1 and 3, 2 and 1, 2 and 3 etc... but if that can be tidied up then fine.

 

Ben

register.zip

[plexer]

Other things that need doing to finish this off are there is a counter field in the db this could be used to count the number of times a person tries to answer the questions. Up to say 3 attempts are allowed before they aren't allowed to try anymore counter is reset on a successfull set of answers.

 

Maybe add date of birth as an additional check.

 

Need to add in validation rules to make sure they pick a question and can't leave it at the default "pick a question" selection, this can be done with the validation .js that's now there.

 

Form to allow them to update their details.

 

Form to allow an admin to lookup their semi secret question used to confirm identity.

 

Ben

[Irazmus]

Right, Self Service Password Reset version 2 is done.

 

New features include:

[*]Easily reskinable front-end template

[*]Client-side and server-side form validation

[*]Lockout counter to prevent malicious use

[*]Multiple methods for new password selection

[*]Static password used for all users

[*]CSV file containing user/password pairs

[*]A random alphanumeric string of fixed or variable length

[*]A password chosen at random from a TXT file of possibilities

[*]A password chosen by the user

[/list:o]

[*]Admin section for looking up user details, resetting user passwords, resetting user lockout counter, removing users answers from database, and verifying user identity with their semi-secret question

[*]Update section allowing users to remove themselves from database so they can reregister

[*]Ability to automatically remove user from database when they reset their password to force reregistration

[*]Two levels of admin access controlled by AD security group membership

[*]Config file containing all implementation specific variables

[/list:o]

 

Full setup details are included in the zip.

 

If there are any more features you'd still like to see in this, let me know and I'll look into doing a 2.1.

sspr-2.0.zip

[plexer]

8 downloads and no comments?

People said this was something they wanted any feedback guys?

 

Ben

[Geoff]

I guess it's perfect and bugfree.

[plexer]

That would be one way of looking at it Geoff

 

Ben

[saundersmatt]

Aaah, just got around to setting it up, took no more than an hour.

 

Thought i'd thank you guys and let you know that we'll be using it from september. Anybody that approaces us to get their passwords reset when we have this in place will be charged for the privilege.

 

Thanks very much.

 

Matt

[MkII]

Will be trialling in the hols - will let U guys know

 

Thanks in advance