GINA 0.9h (beta)

CONTENT:

1.   Introduction
2.   How does it work?
3.   Installation
4.   Registry entries
5.   Messages during operation
6.   System requirements
7.   GinaSetup program
8.   Uninstallation
9.   Notes
10  Bugs
11. History
12. Future
13. Contacts (with some details about the author)
14. Additional Utilities
 

1. Introduction:

• The user can interrupt the login script
• An administrator cannot logoff a user at a remote workstation
• There are no user logon/logoff scripts
• There are no system logon/logoff scripts
• There is no easy way to stop the user using the SAS sequence and taskmanager during logon or any other time.

What does SAS, Winlogon and Gina mean?

Winlogon is a component of Microsoft® Windows NT® that provides interactive, logon support. To allow for independent software vendor (ISV) and developer modifications to the interactive logon model, some aspects of Winlogon are replaceable. Specifically, the identification and authentication aspects of Winlogon are implemented in a replaceable dynamic-link library (DLL). This replaceable DLL is referred to as the Graphical Identification and Authentication DLL, or GINA. GINA lets developers implement smart-card, retinal-scan, or other authentication mechanisms in place of the standard Windows NT user name and password authentication.
 

Winlogon

WINLOGON.EXE is the executable image responsible for implementing interactive logon support. There are many aspects of interactive logon support, including an actual collection of identification and authentication information (as described under the term GINA), and a number of other functions such as window station and desktop management, screen-saver control, and multiple-network provider notifications.
 

GINA

This specification is used by developers who want to replace the component of Windows NT that performs identification and authentication of interactive users. This replaceable functionality is implemented as a dynamic-link library (DLL) which is loaded and called by WINLOGON.EXE. This DLL is referred to as the Graphical Identification and Authentication DLL, or GINA.
 

MSGINA.DLL

The standard GINA shipped with Windows NT is MSGINA.DLL.
 

Secure Attention Sequence (SAS)

Winlogon uses a special sequence of events to recognize when a user wants to log on or perform other secure operations. This sequence of events is referred to as the secure attention sequence or SAS. The SAS provides a secure way for users to enter identification and authentication information. In this way, users are protected from password-collection programs and other flaws inherent in timeshare systems.

As an example, in earlier timeshare systems, users could walk up to an apparently unused terminal and press the ENTER key. The system would then prompt for username and password information. The problem with this was that the terminal could sometimes be in use and with a password collector program running which made the logon appear like a normal logon. However, in reality, the "Trojan horse" program would store away the user's password and then indicate that the user had entered an invalid password (or indicate some other reason why the logon failed). The end result would be that the user just gave his or her password to someone else.

In Windows NT, users can enter a secure attention sequence (SAS). This prompts Winlogon to switch to a secure desktop that no "Trojan horse" program has access to. The SAS for a standard Windows NT system is the CTRL+ALT+DEL key combination. Developers writing a replacement GINA are encouraged to achieve the same level of security with their SAS. By using a device such as a smart-card reader, the SAS could be the insertion or removal of a smart card. Developers can also choose to retain the CTRL+ALT+DEL key combination as the SAS.
 

Winlogon Process

Winlogon serves as the process that authenticates and logs on the interactive user. Winlogon is in one of three states at any given time. These states are illustrated in the following diagram.

 

When Winlogon is in the logged-off state, users are prompted to identify themselves and provide authentication information. If a user provides correct user account information and no restrictions prevent it, the user is logged on and a shell program (such as EXPLORER.EXE) is activated in the user's context. Winlogon changes into the logged-on state.

Logged-on State

When Winlogon is in the logged-on state, users can interact with the shell, activate additional applications, and generally perform their work. From the logged-on state, users can either stop all work and log off, or lock their workstations (leaving all work in place). If the user decides to log off, Winlogon will terminate all processes associated with that logon session and the window station will be available for another user. If, instead, the user decides to lock the workstation, then a secure desktop is displayed.

Workstation-locked State

When Winlogon is in the workstation-locked state, the secure desktop is displayed either until the user unlocks the workstation (by providing identification and authentication information that matches the information provided by the user who originally logged on), or until an administrator forces a logoff. If the workstation is unlocked, the user's typical desktop is again displayed and work can resume. If, however, an administrator unlocks the workstation (by providing the identification and authentication information of an administrator account), the logged-on user's processes are terminated and the workstation becomes available for another user. However, the adminstrator must be in front of that workstation to log off the user.
 
 

Development of the provided GINA:

Microsoft® provides the required information in its development environment called Microsoft® Visual Studio 97 in two subdirectories called "Gina" and Ginastub" in DevStudio\Vc\Samples\Sdk\Winnt\Security\. Most of the information in this readme file is from the help file found in the Gina dirs called "gina.hlp".

There are two ways now to provide GINA functionality:

• Rewrite GINA and provide all functionality in that new GINA
• Hook into the Microsoft® original MSGINA and only provide additional functionality and let the orginal MSGINA do the rest.

This GINA uses some of the functionality of  Alexander Frinks GINA found at http://wwwthep.physik.uni-mainz.de/~frink/nt.html. I have tried to contact Alexander at Alexander.Frink@Uni-Mainz.DE but he never responded to my emails. I wanted to incorporate some/all of his GINA's functionality (not neccessarily using his code). The functionality of his GINA is provided by the GINA in this archive.
 
Back to the top.

2. How does it work?

KeyName: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon
ValueName: GinaDLL
ValueType: [REG_SZ]

If this value is present, it should have a GINA name and the GINA MUST reside in the system32 directory. The name of the PATH does not need to be included in the valuename, it is known to be found in the system32 directory. Winlogon will load and use that GinaDll.

Note: Failure to provide a dll in the system32 once you have set the registry entry will hang your system upon the next boot, because Winlogon will try to load a GinaDll with the specified name and its not there. If you just make the value and do not provide a name and keace it empty the system will try to load a GINA with a name "" and hence stall!

Upon system startup the GinaDll is loaded and stays in memory for the entire system uptime.
At startup it sets up some default values and provides functionality to the LAUNCHER program (provided in this archive) and acts upon the FLAG SETTINGS which are under the root HKEY_LOCAL_MACHINE of the registry under the keys:

    \Software\Microsoft\Windows NT\CurrentVersion\Winlogon
    \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceLogoff
    \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Logoff
    \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Logon
    \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shutdown

and

    \Software\UserCommandLauncher\System
    \Software\UserCommandLauncher\User

These flags decide what the GINA does when certain system events occur, eg the user presses the SAS, logoff, logon and even forcelogoff. These flags (registry entries) are explained below in Registry Entries.

Back to the top.

3. Installation:

You must make sure that you can recover you system to its original working state.
You have a number of possibilites:

• Have an emergency partition available:
• You can have one build into the system on a spare partition, use the minimal install of WINNT to do so.

This copy of the emergency partition is always available, a simple reboot to that partition will solve many problems!
• All systems in my company have a removable hardisk slot so in case of a problem I can boot from that emergency partion.

I have two identical removable disks (in case one fails) which I can use. These disks contain the latest backup of the complete system as well which are used in the company (use NTSID to change the sid numbers) so I can get back any system in under an hour!
• Use ERD commander from NT System Internals to make bootable floppies.

You can get a COMMAND SHELL this way and can fix things.
If you have an emergency partition you can always use REGEDT32 from that booted emergency partition,  go to the faulty partition, load the (faulty) software hive as found in the winnt\system32\config directory, change some values, unload it and reboot to that partition .... and 99.99% of the time you fixed what was damaged!
• Use RDISK from the Windows NT command utilities to make a backup of your registry and other. You can use the 3 NT bootdisks (or bootable CDROM) and the emergency repair disk to get your system back.

• Use Rdisk to make a backup copy of your registry without the "S" switch to backup the registry into the repair directory of the current install. Then use SCOPY to copy your WINNT directory to WINNT2 (or some other name) on the same partition as your system. (you need of course lots of space!) Then expand the BACKED UP registry to the newly created WINNT2 directory and you made a copy of your complete system without the install hassles in a short time!

Precautions:

• the specified gina as in the registry entry is in the \winnt\system32 directory
• the registry entry is pointing to the correct gina.

Unzip the archive:

Unzip the archive into a temporary directory. You can keep this directory afterwards to keep all the binaries at a position related to Gina and Launcher and rename it as you wish.

The only files needed are the Launcher in the \\PDC\netlogon directory and Gina in the system32 directory.
All other files are optional one you have installed everything.
 
 

Installing Gina:

Do it by hand:
Copy the Gina in this archive to the system32 directory.
If you have had a GINA before you must move the old GinaDll to some other name eg Gina.old, Windows uses THAT GinaDll until you reboot! Once you have moved the original gina to a "backup gina" you can copy the new gina into the system32 directory.
Note that you cannot copy over the original GinaDll since the file is IN USE, hence the move first and then the copy.
If you never had a GINA before simply copy the gina into the system32 directory.
The same is valid if your previous GINA has a different name. You can simply copy the new GinaDll into the system dir and set the value GinaDLL in the Winlogon registry entry to point to the new gina and REBOOT to make that Gina the current one.

Example where the gina is in the current directory with a previous gina installed:

    del d:\winnt\system32\LauncherGina.old
    move d:\winnt\system32\LauncherGina.dll d:\winnt\system32\LauncherGina.old
    copy LauncherGina.dll d:\winnt\system32\LauncherGina.dll
 

Once you have copied the gina you must set the registry entry of GinaDLL to point to this Gina for the GINA to become active.
If you have had a Gina and the GinaNames are the same you do not need to do anything other then set the registry entries to suit your needs. You can just call GinaSetup.exe to setup some default values and reboot!
If you never had a Gina you must enter the GinaDLL into the registry for the gina to become active. If you do not enter a name and you reboot nothing will happen, the gina will simply not load!
 

Use Utils provided:

• Use the GinaSetup.exe to copy Gina to the system32 directory.
• Use "CopyGinaToSystemDir.cmd" in the Gina subdirectory of this archive to copy the dll to the system32 directory.

(Execute the script without parameters to get an explanation of the utility).
• Use the "Setup.exe" in the archives "setup" subdirectory and follow the instructions during the setup process.

During the process you will be asked:
1. which type of install you want; either "typical" or "custom".

(in case of the "custom" option you can select which parts to install)
2. where you want the files to be copied to (%systemroot%\Program Files\LauncherGina is the default)
3. whether you want to start copying
Setup.exe then copies the files, creates the folders, makes the shortcuts and creates the registry entries for you!
You can read about the options you have using Setup.

Registry entries:

• Do it by hand (but I think this is cumbersome)
• Use the provided *.reg files to merge the registry entries into the registry using "regedit.exe"
• Use the provided *.regini files to merge the registry entries into the registry using a utility found in the NTRESKIT called "regini.exe". This has the advantage as it sets the permissions as well.

For the setup of a large number of machine I suggest to use the following command to make it easy:

    for /f "skip=3 eol=T" %i in ('net view') do regini -m \\%i winlogon.regini

which would find all the machines on the network and "regini" would set the registry entries on all machines found to the registry values found in the file "usercommandlauncher.regini". I use this command quite often.

• Use the provided "GinaSetup.exe" to setup the registry entries.

4. Registry entries:

• It will introduce the readers to the feature available in this GINA.
• It will show which registry entries to set to request certain features.

Back to the top.
 

5. Messages during operation:

• All output from the user scripts is redirected into the appropriate logfiles so you will be able to find out why a particular step did not work or whether it succeded!
• The output from the logout sequence is written into the ForceLogoffLog as well, so you can remotely see whether the user was logged off (or simply click on the "CHECK" button on GinaSetup!)
• The GinaDll does not produce any information. If there is enough interest I might put some logging infromation into the GinaDll but I do not think it nesseccary.

6.System requirements

• Windows NT 4.0 with Service Pack 3!

Do not install on systems with less than SP3!
• Administrative user rights
• It will NOT WORK on Windows95 as a GINA is not supported on Windows 95.

It will NOT WORK on Windows NT 3.51 and before!

• Intel

7. GinaSetup:

Upon starting GinaSetup checks whether the registry entries required for GINA are available and if available it displays the values as found in the field boxes.

If they are not available the field boxes will be blank and you need to use the "Initialize" button to enter the entries (with default values) into the registry. This has the advantage that you can setup other machines without setting up the machine you are working on (my servers do not have the gina running as no user can log onto them anyway).

You can change the values simply by typing into the field boxes and then press update to write the values into the registry. Pressing cancel will close the setup program without updating the values.
Upon startup you see:

Install Only

• Gina Name

This is the name of the working GinaDll or the one you want to have copy to the system32 directory.
If you have a working GinaDll then this shows the name of the current GinaDll.
Do not change this once you have a working GINA. If you change this, press update and have a GinaDll with a different name in the system32 directory you stall your system, make sure that GinaDll and this name always match! 


• Original Gina

This is the name of the original gina, normally msgina.dll!
Note that there have been problems reported as some of the vendor GINAS do not follow the guidelines by Microsoft and the GinaStubs hooking into those GINAS will fail. Microsoft has reported an number of these in their Knowledge Base!
 
• Copy From

Defaults to the current directory.
It should be the directory containing the GinaDll with the name specified in the GinaName directory.
 
• Copy To

Defaults to the system32 directory of the local/remote computer.
Check whether its correct before copying, it is difficult to find the system32 if there is more than one system32 directory on the remote computer!
 
• Copy

This button starts the process to copy the GinaDll as specified in the GinaName field from CopyFrom to CopyTo.
This does not use the REBOOT MOVE where a file is copied only at boot time.
If there is an error during copy message boxes will appear to explain the reason for the error!

The disadavantage is that the user needs to know the limitations
The original GinaDll (if one is there) MUST BE MOVED to anotherfile eg:

     move mygina.dll mygina.old

before the a new gina can be copied since IN USE system files cannot be deleted but can be MOVED!
WindowsNT then "knows" that the original GinaDll now has a different file name and the file in USE is now the one with the new name. The advantage is you can copy as many as you like to the original name (or leave it blank if you leave the entry to GinaDll in the registry blank as well!)
You cant move another file to mygina.old since that file is now in USE!
 

Normal working conditions:

You need to have the GINA setup and running (rebooted) for these to work!

• Computer

If this is left empty the local computer is used.
If this is not empty and has a name of a computer (inc domain) a remote computer is used. 


• Connect

Connects to the specified computer (re-reads if previoulsy connected). 


• CheckLogon

If pressed it checks whether a user is logged on the specified computer and displays the state. 


• Force User Logoff Connected Machine

If pressed it will log off the user at the specified machine (if none is logged in nothing will happen).
If you press and the machine is local you will logoff yourself! 


• Update

This will write the changes made in the field boxes to the registry. 


• Cancel

This will not write the changes to the registry and stop the program.
 
• Initialize
  This sets up the entries in the registry with default values.
  Note that upon startup this program checks whether there are any values found in the registry and if none are found the field boxes are empty.

8. UNINSTALLATION:

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL

After this step you must reboot the computer so the DLL will not be loaded upn startup.
Then you are able to remove the files:

LauncherGina.dll
LauncherGina.dll.old (if exist)

 
Once you have rebooted you can delete the following values within the keys:

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
    GinaDLL
    NeedCtrlAltDel
    CtrlAltDelBox
    CtrlAltDelBoxNever
    UseCtrlAltDelBox
    ShutdownWithoutLogon
    RunLogonScriptSync
    ForceLogoff
    AllowProtectedSS
    SomeBodyLoggedOn
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\ForceLogoff
        Script
        Logfile
        Timeout
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Logoff
        UserScript
        SystemScript
        LogFile
        timeout
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Logon
        SystemScript
        LogFile
        timeout
        UserScript
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Shutdown
        Script
        Logfile
        Timeout
        Account
        Password

If you delete these values before you have rebooted the machine some of the values will reappear as the still loaded GinaDll will set some of the values again. So make sure the GinaDll is not loaded upon startup before you remove the values or you have to do some of the removals again.
 

For NTREskit Users:

• Make sure you have permissions do delete the keys, ie Administrative rights for THAT machine!
• Make sure the file REG.EXE and CHOICE.EXE are in the path specified by the NTRESKIT environmental variable, these are checked before the util executes!
• Specify the COMPUTERNAME of the remote machine as parameter where you want to delete the values or specify "local" if you want to remove them from the local machine.

 
 

If you used SETUP.EXE you can simply run the UNISTALL option from the Add/Remove panel of the control panel. The name of the unistall option is "LanucherGina".
 
 

Back to the top.
 

9. NOTES:

• Make sure that you have a valid GinaDll in the system32 directory if you specify a GinaDll name in the registry. Your computer will hang with BOD upon reboot once Winlogon is trying to load a not available GINA!

(The same is valid for a mispelled GinaDll!).
• Make sure you have the Emergency disk handy in case soething goes wrong if you do not have another boot partition available!
• It does not matter if you have not setup the registry keys!

You must at least specify the GinaName pointing to the GinaDll.
If you have not installed ALL registry entries the features simply will not be available UNTIL you enter them into the registry or the Gina will setup some itself.
• If you bugger things up you can ALWAYS connect to the machine with problems (Using regedt32) and change the REGISTRY settings on that machine.

If something goes wrong with LAUNCHER simply disable in the settings for a user in USERMANAGER until you found the problem. The same is valid for the GinaName, do NOT simply rename the GinaDll but rather empty the GinaName registry entry.
• You MUST delete the value "GinaDLL" from the SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon key when you want to un-install. Do not leave an EMPTY "GinaDLL" value as it will hang your machine on your next reboot! Why? Winlogon will try to load a GinaDll with no name and because its not there it will hang! There is no way to copy "LauncherGina.dll" to an empty filename like "" to let Winlogon load that file. If this happens to you you must boot to a secondary installation of WinNT (see above) to load the software hive and delete the entry or use the Emergency disk to repair your primary WinNT installation!

10. Bugs:

Please! If you find one dont throw the utility away! Send me some mail and I fix it!

Back to the top.
 
 
 

11. History:

12. Future:

• Uninstall program
• Encrypt password for the shutdown script
• other platforms

13. Contacts:

I have been programming for years in different environments including various flavours of UNIX, OS/2 (Initor is one of my programs there) and for my PhD (some 30000 lines of code!). I have been a Tutor/Demonstrator for various languages including ASM, FORTRAN, PASCAL, COBOL, C and C++. This program is written in C as it would be total overkill to write it in C++!

I look after the LAN in a company (I own it 50%). We had OS/2 but due to companies not providing code for Win3.1 anymore I needed to move to NT. NT certainly has some good features and is better than OS/2 in some cases, but note(!) that in 3.5 years of OS/2 (WARP3) I had not ONE day where the system wasn't working at *ALL* times and the only problem I had every now and then is that an application send some funny chars to the printer and that stopped it working (a little reset fixed that!).
 

Jobst Schmalenbach
Technical Director of Barrett Consulting Group PTY LTD and Part time PhD student
PO Box 277
782 Glenhuntly Road
Caulfield South, Vic, 3162
Australia

Phone : 61  3 9532 7677
Fax   : 61  3 9532 7388
Mobile: 61 41 161  1855

Email : jobst@senna.eng.monash.edu.au (and soon jobst@barrett.com.au)
 
Back to the top.
 
 
 

14. Additional Utilities:

• MSGBOX

This program pops up a message box with a title and message that can be specified.
Furthermore it has a timed option. Use "msgbox /?" to find the command line options.
I found this utility on the net in a zip file without a readme or other documentation and
I have been trying to find the original files.
• SLEEP

This program waits a specified amount of time (sleeps) and then continues.
Use "sleep --help" to find command line options.

Enjoy the "LauncherGina".
Jobst Schmalenbach

Copyright March 1999