[sims] Force Password Change after set days?

[alunmjones]

Im looking to see if anyone has any idea on how to get sims to require a change of password after a set amount of days, i already require the staff to change there password after a set amount of days via AD, im looking to do ssomething similar with SIMS, i have asked our support company that deals with SIMS to contact capita about it but i have not heard back from them yet.

 

anyone have any ideas?

 

im trying to improve our security in every way i can.

[Michael]

There are ways to integrate SIMS with AD, so users have the same username and password. Of course when you change this in AD, it'll be the same for SIMS too.

[alunmjones]

SIMS is running on a different AD domain to the rest of the school system, there is only a link through to the correct ports to get sims to work, hoping to do it without having to change usernames as there would have to be a reference made to link the new usernames with the old ones for the old records to make sence.

 

im hoping that there is a database record i can change (get our support company) that will tell the software to auto tick the change password box on the login page every say 30 days or so.

[matt40k]

If the SIMS server can see the AD they're on, you can use that. In theory anyway.

 

SQL can be set to use your Windows password policy - how well SIMS copes with it is another matter. Simple is no, use AD.

[vikpaw]

So there is nothing in the new system manager that may help in terms of forcing a change?

You could reset it yourself via system manager and email them the password i believe that is possible. Either do it for all on a set day of the week, or stagger it in groups..

[matt40k]

So there is nothing in the new system manager that may help in terms of forcing a change?

 

It's called Windows Authentication

[vikpaw]

It's called Windows Authentication

That's not new and might not work. Emailing could be useful at least.

[matt40k]

and might not work

 

Eh? What do you mean it might not work?

[vikpaw]

Eh? What do you mean it might not work?

Thought the OP said SIMS was on a different domain, so not sure if it will see the other branch of the tree in sysman. Might need fiddling with trust or DNS or something.

[matt40k]

If you can map a drive on other domain, you can use the "runas" to change the Windows User SIMS uses, a slicker example would be: http://matt40k.co.uk/uploads/SIMSADLogin.exe

 

So if you have two domains on say 192.168.0.1/24, this would work, if you have two networks, 192.168.0.1/24 and 192.168.100.1/24 you would need to ensure LDAP etc allowed to be routed between the two, DNS would also need setting up. Assuming all the networking is correct, you would download the above to the SIMS directory, then as the username enter domain\username - for example, admin\blacka from the curriculum domain client (and assuming the connect.ini has the correct Trusted bit in the connect.ini)

[jinnantonnixx]

It's possible, but I wouldn't recommend it.

 

There's a SIMS stored procedure to reset a user password, but this needs a new password. This is a security hole as the password needs to be given to the user.

 

At this point, the password is stored in plain text in the SIMS user record (in the password generated field), while the password valid field as flagged as 'false'.

 

At next login, the SIMS user must type in this password you supplied (which is stored in plain text in the sims record field).

 

The SIMS stored procedure calls an encryption routine which encrypts the new password.

 

At this point the valid password flag is set to 'true' and the 'generated password' field is set to null. The SIMS user is now operating with an encrypted password of their own choosing.

 

It is possible to manually set the 'valid password' flag to TRUE after you call the reset password procedure, which would bypass the 'choose a new password' routine when the user logs in. However, this means that the SIMS user passwords are stored in plain text in the SIMS user table which is an utterly terrible idea. So don't even think about it.

 

I'm sure there's a simple flag in the SIMS system which prompts the user to change the password - this is on the first dialogue box. I might run Profiler to find it at some point, unless someone else knows what the 'change password' option flags up?

Edited August 31, 2011 by jinnantonnixx

[drsox]

I might run Profiler to find it at some point, unless someone else knows what the 'change password' option flags up?

 

Ah.. time to dredge up this ancient thread.. as part of a request relating to the GDPR 'worries' I've been asked if SIMS can expire passwords after X days of no change.

 

It seems that the password_valid = 'F' flag triggers the password change box on SIMS login.

E.g.

  update sims.db_user
 set password_valid = 'F'
 where person_id = 

 

However.. when you then log in and try to change the password... the following stored procedure is run:

exec sims.db_pic_user_password_update @signature=82  @login_name='usernamehere',@old_password_generated='ue/1wyREDACTEDlT+unREDACTED6'  @new_password_encrypted='ue/1wREDACTEDAVO+Yif7+uREDACTEDU'

And SIMS returns:

"Unable to Update User Password, reason passwords mismatch".

 

I presume this is because the "password_generated" field in sims.db_user does not contain the expected plaintext original password.

 

It might be possible to bypass this by modifying the sims.db_pic_user_password_update or sims.db_pia_user_password_update (?) stored procedures to bypass this check - but asking for trouble, things will go horribly wrong for your procedures at the next SIMS update if any of the related stored procedures get reset back to their stock / default.

 

Time to abandon this attempt.. but hope my post stops someone else spending time to discover the same.

[FishCustard]

Obligatory "forced periodic password changes are a terrible idea" advice: https://www.ncsc.gov.uk/articles/problems-forcing-regular-password-expiry

[bobsmith]

as clever as we all are at playing with this stuff, Capita will cut you off with at the knees if they find you doing this.

 

The better solution (which is also Capita friendly) is surely going to be using windows authentication for SIMS, and making sure your windows security is up to scratch?

[matt40k]

Ah.. time to dredge up this ancient thread.. as part of a request relating to the GDPR 'worries' I've been asked if SIMS can expire passwords after X days of no change.

 

It seems that the password_valid = 'F' flag triggers the password change box on SIMS login.

E.g.

  update sims.db_user
 set password_valid = 'F'
 where person_id = 

 

However.. when you then log in and try to change the password... the following stored procedure is run:

exec sims.db_pic_user_password_update @signature=82  @[u][url="http://www.edugeek.net/member.php?u=35181"]log[/url][/u]in_name='usernamehere',@old_password_generated='ue/1wyREDACTEDlT+unREDACTED6'  @[u][url="http://www.edugeek.net/member.php?u=20117"]new[/url][/u]_password_encrypted='ue/1wREDACTEDAVO+Yif7+uREDACTEDU'

And SIMS returns:

"Unable to Update User Password, reason passwords mismatch".

 

I presume this is because the "password_generated" field in sims.db_user does not contain the expected plaintext original password.

 

It might be possible to bypass this by modifying the sims.db_pic_user_password_update or sims.db_pia_user_password_update (?) stored procedures to bypass this check - but asking for trouble, things will go horribly wrong for your procedures at the next SIMS update if any of the related stored procedures get reset back to their stock / default.

 

Time to abandon this attempt.. but hope my post stops someone else spending time to discover the same.

 

Bang goes you're support because you couldn't be bothered to use Windows Auth

[FishCustard]

as clever as we all are at playing with this stuff, Capita will cut you off with at the knees if they find you doing this.

 

The better solution (which is also Capita friendly) is surely going to be using windows authentication for SIMS, and making sure your windows security is up to scratch?

 

Generally a good idea to have separate auth for sensitive systems like SIMS, so that in the event that a staff user account does become compromised, whoever has it doesn't have automatic access to SIMS as well.

 

EDIT: Read subsequent posts - seems that SIMS' auth system is... less than ideal in security terms.

 

My recommendation would be to give users a suitably complex (i.e. >=12 characters, ideally >16 char) password and then not have periodic changes (doing so just encourages sequences like passw0rd1, passw0rd2, etc.). If people complain about complexity, you can scapegoat GDPR.

Edited March 23, 2018 by FishCustard

[drsox]

Obligatory "forced periodic password changes are a terrible idea" advice: https://www.ncsc.gov.uk/articles/problems-forcing-regular-password-expiry

In this instance I agree... pretty pointless expiring passwords for an internal system and low attack surface (you have to be on the network, logged in as a user with access to the SIMS share and know what SIMS is and how you could abuse access to it).

 

In other remote access scenarios "credential stuffing" (using stolen credentials from elsewhere to get into other services) is a real problem and some sort of password expiry (albeit every year or two years) is not too inconvenient for the user and adds some sort of protection against credential stuffing attacks.

Edited March 23, 2018 by drsox

[FishCustard]

In other remote access scenarios "credential stuffing" (using stolen credentials from elsewhere to get into other services) is a real problem and some sort of password expiry (albeit every year or two years) is not too inconvenient for the user and adds some sort of protection against credential stuffing attacks.

Agreed, which is why I recommended generating passwords for the users. Although as you say, the attack surface here is limited.

[matt40k]

Generally a good idea to have separate auth for sensitive systems like SIMS, so that in the event that a staff user account does become compromised, whoever has it doesn't have automatic access to SIMS as well.

Nope. That's very bad advice. SIMS Auth pretty easy to hack - it doesn't get locked out for starters. It's better to use Windows Auth then use the build in OS stuff then some crooked system someone at Capita created decades ago (clever as it was - it's v.dated).

 

I'm guessing you have a S drive, I'll wager there is a census file - which is basically a plain text data dump and possibility payroll info on there. Better to press Windows + L then setting up a false wall

[bobsmith]

Generally a good idea to have separate auth for sensitive systems like SIMS, so that in the event that a staff user account does become compromised, whoever has it doesn't have automatic access to SIMS as well.

 

My recommendation would be to give users a suitably complex (i.e. >=12 characters, ideally >16 char) password and then not have periodic changes (doing so just encourages sequences like passw0rd1, passw0rd2, etc.). If people complain about complexity, you can scapegoat GDPR.

I totally agree with the separation of the authentication - however as SIMS does NOT in fact have any options for you to set up password complexity this doesn't leave us any better off.

 

My warning was aimed at dissuading people from playing around with the SIMS SQL database to try and force password policies - the cost to your organisation is going to outweigh the benefits.

[drsox]

I never thought dredging up such an old post would result in so much conversation Happy Friday everyone!

[FishCustard]

Nope. That's very bad advice. SIMS Auth pretty easy to hack - it doesn't get locked out for starters. It's better to use Windows Auth then use the build in OS stuff then some crooked system someone at Capita created decades ago (clever as it was - it's v.dated).

Hmm, fair enough if SIMS auth is that bad. No lockout so people can just try as many credentials as they want against the server as fast as they can? Okay, they'd need to be on the network to do so but still.... eeehhhh!

 

The whole (not) locking of PCs when people walk away is a separate issue that opens up a whole load more security holes.

Edited March 23, 2018 by FishCustard

[rom1984]

I had a conference call this week with Dr Lorrie Faith Cranor who is a computer scientist specialising in password research and authentication.

 

She was talking about credential stuffing and that in her research she found that if an attacker knows the persons first password, in 40% of the time they can crack the second password in less than 40 seconds so she advised against forcing any password changes.

[matt40k]

I never thought dredging up such an old post would result in so much conversation Happy Friday everyone!

 

Fish and chips just arrived

[drsox]

if an attacker knows the persons first password, in 40% of the time they can crack the second password in less than 40 seconds so she advised against forcing any password changes.

Presuming that it is a targeted attack. My main concern with remote access is wholesale automated testing against stolen credentials.

Fish and chips just arrived

I have a potaco! Baked potato with the filling and sauces that would normally be in a Taco! Yum. Edited March 23, 2018 by drsox