OpenPasswordFilter is an open source custom password filter DLL and userspace service to better protect / control Active Directory domain passwords.
Troy Hunt has wrote a blog post where he published 324+ millions of password hashes from breaches in past, so what I did is that I took those files, loaded them in SQL database and modified OPF to query those instead of password lists as in the original project.
I have added configuration options in OPFilterService.config so you can configure OPF to use either of those, enable logging, etc.
You can find the original project tree here.
Accompanied blog post about installation and more detailed instructions can be found on my blog.
Here is the descriptive part of readme from the original project.
The genesis of this idea comes from conducting many penetration tests where organizations have users who choose common passwords
and the ultimate difficulty of controlling this behavior. The fact is that any domain of size will have some user who chose
Password1 or Summer2015 or Company123 as their password. Any intruder or low-privilege user who can guess or obtain
usernames for the domain can easily run through these very common passwords and start expanding the level of access in the
domain.
Microsoft provides a wonderful feature in Active Directory, which is the ability to create a custom password filter DLL. This
DLL is loaded by LSASS on boot (if configured), and will be queried for each new password users attempt to set. The DLL simply
replies with a TRUE or FALSE, as appropriate, to indicate that the password passes or fails the test.
There are some commercial options, but they are usually in the "call for pricing" category, and that makes it a little prohibitive for some organizations to implement truly effective preventive controls for this class of very common bad passwords.
This is where OpenPasswordFilter comes in -- an open source solution to add basic dictionary-based rejection of common passwords.
OPF is comprised of two main parts:
- OpenPasswordFilter.dll -- this is a custom password filter DLL that can be loaded by LSASS to vet incoming password changes.
- OPFService.exe -- this is a C#-based service binary that provides a local user-space service for maintaining the dictionary and servicing requests.
The DLL communicates with the service on the loopback network interface to check passwords against the configured database of forbidden values. This architecture is selected because it is difficult to reload the DLL after boot, and administrators are likely loathe to reboot their DCs when they want to add another forbidden password to the list. Just bear in mind how this architecture works so you understand what's going on.
NOTE The current version is very ALPHA! I have tested it on some of my DCs, but your mileage may vary and you may wish to test in a safe location before using this in real life.
You can download a precompiled 32 and 64-bit version of OPF from the following links:
| File | MD5 sum | SHA1 sum |
|---|---|---|
| x64.7z | 69aeafa5a543f28a542345e621c1b8ab | 8af16eafa2d9b136b3d77ae4b380667f498b3d17 |
| x86.7z | 48dd6bc5980201e8e20aabfcf89d1d70 | 67f9e18ba974b6fdf60fd64252438c5e0e0cb8f5 |
Please verify hashes before putting them on your servers.
TL;DR:
- Copy complete release catalog to some place on disk
- Run
\windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe OPFService.execommand to install the service - Start the service
- Copy
OpenPasswordFilter.dllto%WINDIR%\System32 - Validate that
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packagesregistry key contains OpenPasswordFilter value - Configure SQL settings in app.config
- Start the service and test if it works with provided OPFTest.exe which queries service using OpenPasswordFilter.dll
- Restart the DC server so changes to LSA takes place
- Repeat for the rest of your DC servers
If all has gone well, test by using the normal GUI password reset function (ctrl+alt+del) to choose a password that is on your forbidden list. If not enable logging by setting OPFLoggingEnabled to true in OPFService.config, restart the service and check logs for errors.
P.S.
In case you decide to recompile the project and change OPFClientRecognitionKeyword you will need to change value of line 96 in dllmain.cpp to match the new keyword.