Technique | Painless passwords

A couple of years ago, the National Institutes of Health established a more secure policy for passwords on its networks. Each password must be at least seven characters; include upper- and lower-case letters, numbers and special characters; and be changed every 180 days.'It's not too bad, once you get used to it,' said Tom Carrington, senior network engineer at Terrapin Systems, which provides network support for NIH's National Cancer Institute.But users at NCI, one of 27 semiautonomous institutes at NIH, were not crazy about the changes.'It's almost like an academic environment,' Carrington said. 'Most of the people here aren't interested in the network and security. They just want to play in their labs. So there was a lot of grass-roots resistance.'There was some resistance to several requirements from the information technology administrators, also.'We were never keen on changing passwords, because of the headaches,' Carrington said.NCI has two separate directories, Microsoft Active Directory and Novell eDirectory, which complicates password changes.'A lot of the PC users were OK, but with Mac and Unix stations, they would change it on one side and not be able to get it to the other side,' resulting in multiple passwords for some users, Carrington said. The 180-day change policy would only complicate that problem. 'We knew that when it went live, every password older than 180 days would create a groundswell of password changes,' and most likely a groundswell of calls to the help desk.'We had a little bit of lead time,' so Carrington and his staff began looking for a tool to help users manage their passwords. They considered a number of products, including BindView Password Self Service, which lets users reset passwords after authenticating them through personal questions, and Novell Identity Manager, which provides hints for forgotten passwords and uses a challenge-response scheme to allow resets.'We couldn't use either of these because we don't have access to the domain controllers themselves,' Carrington said. 'That's at the NIH level, above us in the food chain.'They did a 45-day trial of Password Station from Avatier, eventually extending the trial for another 45 days.'Once it got into use, the feedback was great, and we decided to spend some money on it,' Carrington said.Password Station provides a Web interface for users to enroll using their network log-on ID at a licensing cost of about $10 per enrolled user, depending on volume. During enrollment, the user answers from one to nine personal questions from a list that will be used later for authentication.'The standard defaults to three' questions, said Wade Ellery, Avatier director of sales and service. 'Most of our customers stay with three.'Password Station does not store passwords or answers. Passwords remain with Active Directory. The server does a one-way Secure Hash Algorithm of the answers used to authenticate users and allow password resets, so Password Station does not know the users' answers.Forgotten passwords are 'normally the reason people come to Password Station,' Ellery said.The tool also has a help desk page that gives administrators user account information.Because the server does not store passwords, multiple servers can be used for redundancy or load balancing. But most customers with fewer than 10,000 users, such as NCI, use only one server. NCI so far has enrolled about 4,000 of the 6,000 users the IT department supports.The toughness of the authentication policy is set by the customer. The questions are simple but not likely to be generally known by others, such as favorite teacher or song, personal hero or birthplace. NCI sets the bar fairly low. It enrolls its users with three questions and requires only one to be answered correctly to reset a password. Incorrect answers can generate an e-mail notification to administrators or the account holder so they can be alerted if someone is improperly trying to change a password.Several options are available for giving users access to the Password Station server. One is to include a 'forgot password' button on the log-on page that will launch a secure browser and automatically load the Password Station page. A second way is to allow log-on to a generic password reset account with a public password that gives access to Password Station.NCI opted not to use these methods.'We already have two log-on prompts, Windows and Novell, and we were leery about rolling out another one,' Carrington said.Password Station is not mandatory, Carrington said. Since it was implemented more than a year ago, enrollment has been climbing steadily. But those who choose not to enroll will have to remember their more complex passwords on their own.