Share via

Passgen tool from my book

  • Article

Way back in 2005, Jesper Johannson and I wrote Protect Your Windows Network. It’s still available, and although its product set is now somewhat dated (Windows XP and Server 2003), much of the practical advice about security policies, social engineering, security dependencies, and how to think about security remains relevant. That’s because we strove to write something more lasting than a simple configuration guide.

On the CD-ROM accompanying the book we included a tool called Passgen. In the book, we recommended that you maintain separate passwords on every local administrator and service account in your enterprise. This is, of course, almost impossible to manage without something to automate it for you. That’s what Passgen does. The tool generates unique passwords based on known input (an identifier and passphrase you define), sets those passwords remotely, and allows you to retrieve them later.

For a while Jesper maintained a web site for the book, running on a server in his house. His ISP changed policies and made it impractical to continue running the site. But because the tool is still so useful, I’ve put a copy in my SkyDrive—look in the “Passgen” folder.

Also, note that I’ve put a new section in the right-side column, “Resources for you.” Here’s where I’ll keep links to bits and pieces that many of you will find relevant and interesting.

Update. A few readers have informed me that the SHA-1 hash printed in the README.DOC doesn’t match the actual hash of passgen.exe. Jesper made a few changes and recompiled the tool. The correct hash is now:

fa19722348e9e0603f24c0ef9fc715010403bcfa

I’ve updated the README file with the new hash. Also, passgen.exe has a digital signature, and you can check its details if you’d like.

Comments

  • Anonymous
    January 01, 2003
    Letzte Woche habe ich mit Entfernen von Conficker.B eine Kurzanleitung gepostet, wie man Conficker.B

  • Anonymous
    January 01, 2003
    Occasionally, I see a security incident where one of the things that went wrong was that all of the customer's

  • Anonymous
    January 01, 2003
    The comment has been removed

  • Anonymous
    January 01, 2003
    Hi All, We’re seeing an increasing trend globally in the number of infections of the Conficker.B worm.

  • Anonymous
    January 01, 2003
    The comment has been removed

  • Anonymous
    January 01, 2003
    Over the last few days I blogged several times about Conficker and some of the posts caught quite some

  • Anonymous
    January 01, 2003
    Archie-- we have some guidance on removing Conficker.B. The Microsoft Malware Protection Center describes the worm's infection vectors and mentions that they've added removal capabilities to the Malicious Software Removal Tool: http://blogs.technet.com/mmpc/archive/2009/01/13/msrt-released-today-addressing-conficker-and-banload.aspxThe Knowledge Base has an article that describes how to manually clean an infected computer: http://support.microsoft.com/kb/962007

  • Anonymous
    January 01, 2003
    The comment has been removed

  • Anonymous
    September 29, 2008
    Thanks for putting your power point slides up on skydrive :)

  • Anonymous
    September 30, 2008
    The comment has been removed

  • Anonymous
    October 02, 2008
    The comment has been removed

  • Anonymous
    November 27, 2008
    My favorite passgen is a random kick on keyboard :). Please add Visual Interface to the program if you have some spare time.

  • Anonymous
    January 18, 2009
    Until now there is still no ultimate cure for the Conficker.B worm. Any suggestions ?

  • Anonymous
    April 16, 2009
    How secure is the transmission of the new password, when setting it for a remote machine (passgen -s * -c username -m computername)? I see that it’s not transmitted in clear text, but am curious as to the likelihood of someone who successfully captured the traffic eventually decrypting it. Thanks for a great tool.