Re: ADS Password Storage Protection

[Eoin Miller <eoin.miller () trojanedbinaries com>]

rolando_ruiz () jetaviation com wrote:
> I'm looking for best practice ways of protecting access to password
> storage in Active Directory. I have some immediate questions:
>
> Where exactly are passwords kept?
> Are these passwords kept in plain text?
> How can I protect these passwords from being hacked? (Encryption,
> restrictions, etc...)
>
> Thank you in advanced 
>
> ________________________________
>
> Jet Aviation Holdings, Inc.
> Rolando Ruiz
>
>
> ---------------------------------------------------------------------------
> This list is sponsored by: SensePost
>
> Hacking, like any art, will take years of dedicated study and  
> practice to master. We can't teach you to hack. But we can teach you  
> what we've learned so far. Our courses are honest, real, technical  
> and practical. SensePost willl be at Black Hat Vegas in July. To see  
> what we're about, visit us at: 
>
> http://www.sensepost.com/training.html
> ---------------------------------------------------------------------------
>
>   
You will want to ensure that passwords are not stored using reversible 
encryption (by default they are not). This is generally only required if 
you are configuring a RADIUS server that will use CHAP for 
authentication. More information on reversible encryption settings for 
Windows password policies can be found here:

http://technet2.microsoft.com/WindowsServer/en/Library/eeff044c-d4a8-4699-a4b8-c5e563118c931033.mspx?mfr=true

I would also review the Windows Server 2003 Security guide starting 
around page 33. That is where they begin discussing password policy. It 
is available here:

http://www.nsa.gov/snac/os/win2003/MSCG-001R-2003.pdf

--Eoin

---------------------------------------------------------------------------
This list is sponsored by: SensePost

Hacking, like any art, will take years of dedicated study and  
practice to master. We can't teach you to hack. But we can teach you  
what we've learned so far. Our courses are honest, real, technical  
and practical. SensePost willl be at Black Hat Vegas in July. To see  
what we're about, visit us at: 

http://www.sensepost.com/training.html
---------------------------------------------------------------------------