Self Service Password Reset

[dezt]

Still not sure what ADODB is / or how to set it up.

 

ASP seems to be ok but I still get a page not found when i navigate to the web page.

[Diello]

Just implemented here - brilliant! Thank you

[plexer]

Ok if anyone wants to try this out please do and let me know if it works for you or not.

 

I think I may have made a mistake in the directory structure of my last zip file.

 

I had trouble attaching it to the post so I've upped it to my website

 

http://www.plextech.co.uk/SSPR2.0.1-b1.zip

 

Ben

SSPR2.0.1-b1.zip

[boomam]

Got a bit further.

Still not working though.

 

Ive setup two user accounts.

One called "resetpassword" thats a normal user, set to load IE as the GUI as specified in the readme.

The other is a domain admin called "resetpasswordadmin".

 

I can load the first interface logged in as my test pupil, with the address: "http://server:81/register/register.asp". Problem is there that the 'username' box appears blank, but everything goes through without error.

 

If goto the reset page, enter the test pupil account that i previously registered, to which it says that the user isnt registered?

So i go back to the register page, and aparentely its already registered!?

 

Is there a more indepth install guide around anywhere? Because while the 'quick install one' is there, half the information on it is incorrect in my case, running the IIS manager that comes with R2. So im having to wing half of it, guessing as i go along.

 

Just to check, the two accounts ive setup, the standard user one is for....kiosks?

And the domain admin one is for the program itself to have access to change the passwords?

 

 

If someone could help me get this working, it would be VERY much appriciated. .

Edited January 17, 2008 by boomam

[plexer]

Ok I will install R2 on my test 2003 DC and see what the differences are.

 

I will take some screen shots as I install and configure it and make a pdf guide for it.

 

I'll post it when it's done, I need to do this anyway as I want to release it to the wider world.

 

You don't need the resetpassword user to test if it working you can go to http://servername/reset/index.asp as your normal user and that will run the same reset password pages.

 

Ben

[boomam]

Ok I will install R2 on my test 2003 DC and see what the differences are.

 

I will take some screen shots as I install and configure it and make a pdf guide for it.

 

I'll post it when it's done, I need to do this anyway as I want to release it to the wider world.

 

You don't need the resetpassword user to test if it working you can go to http://servername/reset/index.asp as your normal user and that will run the same reset password pages.

 

Ben

Thanks.

Looking forward to the guide. I think this app has the potential for good things for IT admins..

[dezt]

OK, i'm having a thick day today, just downloaded the 2.0.1-b1 version and followed the instructions in the readme file, everything seems to be working fine now, i hadn't set active server pages to allow, just asp.net in extensions.

 

Thanks for this really good useful tool.

[plexer]

dezt: Glad to have helped you get it working.

 

Let me know how you get on with using it please.

 

Ben

[rvdmast]

@ BOOMAM,

Like plexer said, my setup allows pupils to access the reset-pages from the windows login screen without having to login first. It display's an extra button below the "press CTRL-ALT-DEL..." dialog that opens the reset pages in a tightly restricted full screen browser.

 

Right now i am a little short of time, but i've already promised plexer i'll post

a description how i achieved this in this thread, later this week or next week.

So sit tight...

[boomam]

Thanks.

Helpfull community this is. .

[Irazmus]

It's been quite a while since I last posted so be warned this may be a long one.

 

I noticed that on the update page, once you filled everything in correct, the redirection to the next page (\register) didn't work.

I can't believe I overlooked that, I've updated update_details.asp and the installation instructions to fix that.

 

I'm still having problems reaching the admin pages from remote computers.

I've made quite a few changes to the admin pages, hopefully that should have solved the problem, if not let me know and I'll see what I can find.

 

I've taken a different aproach here: with the help of some free tools and a compiled autoit script i made i've been able to set up a kiosk machine where there are 2 extra buttons on the login screen (where it says press CTRL+ALT+DEL) which open a full screen browser (kiosk mode) to either the password reset page or our printer accounting page.

I would love to see how you did that, it would make the system so much easier than having to run it from a separate logon.

 

Is there a more indepth install guide anywhere?

I'm working on a screencast of a basic deployment as a more descriptive install guide which I hope to post in the next few days.

One question though, are you running SSPR on a DC or a member server?

Until recently I've only tried SSPR running on DCs, but I've just moved it to a member server while reorganizing the network, and have found that SSPR breaks rather badly if it's not on a DC (it can't reset passwords due to the 2 hop limitation inherent in NTLM). The fix for this bug is in the latest version below.

[Irazmus]

New SSPR release

 

Plexer and I managed to get out of line with our version numbers so this release is rather oddly version 2.2.1, and no you didn't miss 2.1 and 2.2 as they were superceded before I released them ^^;

This release includes Plexer's changes in 2.0.1-b1, which in my timeline fall in 2.2

 

 

** Change Log v2.2.1 **

--------------------------------------------------------------------------------

* Added admin reset counter & last admin reset date to user details in admin console

* Added new table userdata to database to record last admin reset date and total number of admin resets per user

* Added Password Last Set to administration console

 

** Change Log v2.2 **

--------------------------------------------------------------------------------

* Modified admin\auth.asp to convert all group names to lower case to prevent case sensistive errors.

* Fixed problem where password cannot be changed if IIS is not running on a Domain Controller

* Added impersonation settings to config.asp for use with above fix

* Added LoginAdmin.dll for use with above fix

* Corrected error where update_details.asp was ignoring setting of HashAnswers

* Replaced all occurances of Response.Redirect "/register" with Response.Redirect "/register/register.asp"

* Removed evil hacks from reset_pass.asp and adminreset.asp, replaced with proper error checking

 

** Change Log v2.1 **

--------------------------------------------------------------------------------

* Added option for user answers to be held in plain text rather than hashed

 

 

[ Information for those updating an existing install ]

 

* Important config changes *

Pages in the reset directory no longer need to be run with elevated privileges in IIS as 2.2 uses inline impersonation to modify AD

Members of the resetGroup and adminGroup no longer need privileges to reset passwords in AD

There is a new file cred.ini which needs to contain logon credentials for an account with AD premissions to reset passwords

A new dll, LoginAdmin.dll, needs to be registered to allow SSPR to impersonate the user detailed in cred.ini when changing passwords in AD

The database has a new table which is needed by the admin pages. If upgrading an existing install this table will need to be added to the database manually

Table : userdata
username	text
resetcount	int
resetdate	text

Alternatively you can rob it from the included reset_db.mbd

 

* New files *

LoginAdmin.dll

cred.ini

wwwroot/iniread.asp

 

* Changes to config.asp *

CredFile = "c:\Inetpub\cred.ini"

Location of credentials file for impersonation.

Located outside web directories for security

HashAnswers = False[code]
Are user's answers stored hashed or plaintext? Hashed increases security, plain text helps with admin authentication when kids forget how they spelled their answers
[code]%>

<%
ImpersonateUser = ReadINI(CredFile, "Main", "ImpersonateUser")
ImpersonateUserPass = ReadINI(CredFile, "Main", "ImpersonateUserPass")
%>

Reads contents of CredFile

 

[ / Information for those updating an existing install ]

 

 

I'm pretty sure there are no major bugs, but please post back if you find one.

 

EDIT: File updated to fix error in auth.asp

SSPR 2.2.1 Final v2.zip

Edited February 4, 2008 by Irazmus

[boomam]

One question though, are you running SSPR on a DC or a member server?

Until recently I've only tried SSPR running on DCs, but I've just moved it to a member server while reorganizing the network, and have found that SSPR breaks rather badly if it's not on a DC (it can't reset passwords due to the 2 hop limitation inherent in NTLM). The fix for this bug is in the latest version below.

 

I have it installed on a seperate IIS to the DC. .

[Irazmus]

I have it installed on a seperate IIS to the DC. .

 

That's at least part of the problem then. Give 2.2.1 a try and see if that solves things for you.

[boomam]

That's at least part of the problem then. Give 2.2.1 a try and see if that solves things for you.

Im not sure i'll have time at the moment, so it'll be a while before i get the chance..

[rvdmast]

As promised, here's how to create a “reset password” button on the login desktop, so that users whom forgot their password, and therefore cannot log in, are still able to acces the password-reset website. For the actual password resetting we use the “Self Service Password Reset” free software by Ben "Plexer" Norcutt and Alex "Irazmus" Kitching wich can be found here:

http://edugeek.net/forums/showthread.php?t=2022&page=8

this article only shows how to create a “reset password” button on the login desktop wich opens your password reset page once you set up “Self Service Password Reset”.

 

 

The most difficult part is getting something to show on the login desktop. Windows uses the concept of Windowstations and Desktops. The screen you see before anyone has logged in to the computer, called WinSta0\WinLogon, is a different desktop in a different Windowstation then the desktop you see after someone has logged in, called WinSta0\Default . These Desktops/Windowstations are completely separated and programs running in one desktop cannot access programs on another desktop.

Also, to run anything on the login desktop you need certain privileges (rights) which normaly only the SYSTEM account has.

 

Fortunately there is the utility RunProcess.exe by Frank P. Westlake which among many other cool things allows you to start a process on any windowstation/desktop if you have the appropriate privileges. You can download it here: http://www.jsifaq.com/SF/Tips/Tip.aspx?id=7127

 

Next, we need to create a windows service to run our program. Why? Firstly because we need the appropriate privileges and a service running under the system account has these. Secondly we want our program to start without anyone having to login. This is what services are for.

Since, like most programs that require user interaction, the actual program which will present the reset button does not support running as a service, we will create a “wrapper service” which will load our program. This is NSSM: The Non-Sucking Service Manager

http://iain.cx/src/nssm/

 

Finally there’s the actual program which does nothing more than show a button which opens your password reset page in Internet explorer. It’s a simple compiled AutoIt script, source code included.

 

There are some security issues you should be aware of. This system runs Internet explorer under the SYSTEM account which has full administrative access to anything on your computer! Should a user be able to browse to a malicious site in this browser then the results might be disastrous. We need to limit what a user can do and where he can surf on the computer where this system runs.

 

First we will use Internet explorer’s content rating system to make your password reset website the only website users are allowed to visit. They cannot visit any other websites unless they know the Parental control password. (Default is “w3lk0m”). This is done by copying a ratings file (lockdown.rat) to the system directory and importing some registry entry’s from the file “pwreset.reg”

IMPORTANT: you must first edit the file pwreset.reg with notepad and replace any instance of “yourdomain.com” with the URL/domain of your choice

Secondly we need to disable all unwanted toolbars, buttons etc. in Internet explorer. You could use Group Policy to do this, or you could manually double click the file

ie-restrictions.reg which is just a sample of what you could do. The installer does not do this, it’s your choice.

Finally, as said above, this system runs Internet explorer under the SYSTEM account which has full administrative access. But we can take away these rights for just the Internet explorer without restricting the SYSTEM account (which would probably break your computer) by using Software restriction policy’s. To do this, enable SAFER technology by creating the following registry key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers]

Key: "Levels" (REG_DWORD)

Value: 00031000

Or just double click “safer.reg”

Then open the (local) Group Policy editor by typing “gpedit.msc” in Start/Run.

Under “Computer configuration” go to Windows settings/Security Settings/Software Restriction Policies/Security Levels. You should see 5 trust levels: Disallowed, Untrusted, Restricted, Basic user and Unrestricted.

Now go to Windows settings/Security Settings/Software Restriction Policies/Additional Rules, Right-click and create a new “Path Rule”, Enter the path to iexplore.exe for ie.

“C:\Program Files\Internet Explorer\iexplore.exe” And set the security level to Basic user, or Resticted if you want guest-level acces for IE. Now IE will ALWAYS run with limited rights, regardless which user executes it (even Administrator or SYSTEM)

 

To make setting all this up easier I have created install.cmd which does most of the work to install this. Only the restricting of IE’s user interface and the creation of a software restriction policy has to be done manually.

pwreset.zip

[Irazmus]

@boomam: No worries, no need to hurry on my account

 

@rvdmast: Cheers for that, I'll have a proper look at that tomorrow. Also, do you use that on all machines or just selected clients?

[rvdmast]

Right now, we use this only on one dedicated workstation in our library.

Mostly because we were still testing this, and, as you can see in my how-to it still requires some manual tweaking on each workstation.

Plus, we've published the SSPR on our ISA servers so they can also reset their password from home. So one dedicated workstation is really enough.

[Irazmus]

@rvdmast: Good point, but it shouldn't be too difficult to tag that setup on the end of BDD. I'll have a go when I have a few minutes.

 

And if anyone wants the 2.2.1 install screencast it's now up @ http://www.filefactory.com/file/9e8f3b/

Comments and criticisms are welcome.

[rvdmast]

Now that there's a new version of SSPR I've been thinking about a few things:

1 - I spent half a day translating all the texts in the ASP files to Dutch. When i install a new version I'd have to do that all over again. And something tells me this isn't the last version to come out

I'm no expert at ASP (yet, though i did read up & practice a bit) but would it be possible to use a language file like language.asp that you would #include which contains these texts for a specific language? I'm thinking this file could be just a bunch of string variables with the appropriate texts. Then in the .asp files you'd replace the texts that are currently there with the appropriate variable from language.asp...

So, if you want English texts you'd download & use the English language.asp, German user would use the German language.asp etc... These could of course be created and submitted here by users themselves.

 

2 - How difficult would it be to create an installer? I've seen other installers set up websites in IIS and configure them as required. And if i remember correctly one can import/export IIS settings. And something tells me one could probably do a lot with vbscript or something...

[boomam]

Just tryed it with the video guide.

Ive gotten a bit further now, now i can register, and it does show the questions on the reset screen correctly.

Problem now is that when it says enter new password, i enter it, then it errors with:

 

Error: unable to bind container

 

 

Ideas?

 

 

+ for future reference, is there a way to have this self contained in its own folder, rarther than the default system one, as if theres other apps that need to use that folder for installation/usage, conflicts will arise.

 

 

On another note, might be worht adding, at the top of the tree in IIS, i had t set 'default website', its IP and port to something less generic, in my case, 172.17.0.50 & 9000 for it to display the pages on remote machines.

 

.

[boomam]

Odd.

Ive added the SSPR_servername user to those two security groups, and then proceeded to test again, nothing but HTTP500 errors now?

And removing them still makes the error happen.

 

##EDIT##

Fixed the problem. I replaced the config.asp and the Db with the originals.

 

The 'Error: unable to bind container' error still happens though.

 

+ Whats the point in the two security groups ive had to create? I havnt had to specify them anywhere in of the configs?

Edited January 25, 2008 by boomam

[plexer]

Booman: this can be run from a new website on your iis server doesn't have to be the default one.

 

I think I'll test it on my vm.

 

Regarding the install this is something I thought about this week and did post a question about it.

 

If we can find a free/open source tool that works well then yes it will be a setup file.

 

Wix apparently can do it.

 

Ben

[boomam]

Fair enough, i'll have a play having it on its own website when i redo the IIS in the summer.

 

Any idea on the error message?

 

Thanks.

.

[plexer]

boomam: do you have friendly errors turned on in internet explorer on the client you are using to test?

 

If so please turn them off and post the real error message.

 

Ben