Pwned Passwords Check

Problem this snippet solves:

This snippet makes it possible to use Troy Hunt’s ‘Pwned Passwords’ API. By using this API one can check if the password being used was exposed in earlier data breaches. You can use this information to deny access to highly secure resources or to force a user to first change it’s password to one that isn’t known to be exposed to earlier data breaches. Or you could choose to just to inform a user that it would be wise to change it’s password.

It’s good to note that the password itself will not be shared while using this API. This snippet uses a mathematical property called k-anonymity. For more information about k-anonymity and Troy Hunt’s ‘Pwned Passwords’ API see:

https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/

This snippet also uses Patt-tom McDonnell’s hibp-checker node package.

How to use this snippet:

Prepare the BIG-IP

• Provision the BIG-IP with iRuleLX.
• Create LX Workspace: hibp
• Add iRule: hibp-irule
• Add Extension: hibp-extension
• Add LX Plugin: hibp-plugin -> From Workspace: hibp

Install the node.js hibp-checker module

# cd /var/ilx/workspaces/Common/hibp/extensions/hibp-extension/
# npm install hibp-checker --save
/var/ilx/workspaces/Common/hibp/extensions/hibp-extension
└── hibp-checker@1.0.0 
#

irule

To make it works, you need to install the irule on the Virtual Server that publish your application with APM authentication.

access profile

If you already have an existing access profile, you will need to modify it and include some additionnal configuration in your VPE. If you have no access profile, you can starts building your own based on the description we provide below.

Configuring the Visual Policy Editor

The printscreen below is an example Visual Policy Editor on how you can use the Pnwed Password snippet.

VA – Force Password Change

This is a Variable Assignment agent that triggers APM to show a Change Password window. Set variable:

session.logon.last.change_password

expr { 1 }

VA – Get Password

This is a Variable Assignment agent that copies the password to a session variable that can be read by the hibp irule. Set variable:

session.custom.hibp.password

return [mcget -secure {session.logon.last.password}]

IE - HIBP

This is an irule event with the ID set to ‘hibp’. This will trigger the hibp_irule to come into action.

EA – HIBP Verdict

This is an Empty Action with two branches. The branch named "Not Pwned" contains the following expression :

expr { [mcget -nocache {session.custom.hibp.status} ] == 0 }

MB – Exposed Password

This is a message box that will inform the user that it’s password was exposed in earlier data breaches and a password change is needed. The message could be something like this:

The password you are using was found in %{session.custom.hibp.status} data breaches. In order to be compliant with our security policy, you must change your password.

hibp_irule

when ACCESS_POLICY_AGENT_EVENT {
    if { [ACCESS::policy agent_id ] eq "hibp" } {

        set password [ACCESS::session data get session.custom.hibp.password]
        set failonerror 0

        if { $password eq "" } {
            log local0. "Error: no password set"
            ACCESS::session data set session.custom.hibp.status $failonerror
            return
        }

        set rpc_handle [ ILX::init hibp-plugin hibp-extension ]
        if {[ catch { ILX::call $rpc_handle -timeout 12000 hibpCheck $password } result ] } {
            log local0. "hibpCheck failed. ILX failure: $result"
            ACCESS::session data set session.custom.hibp.status $failonerror
            return
        }

        ACCESS::session data set session.custom.hibp.status [expr { $result }]
    }
}

Code :

var f5 = require('f5-nodejs');
const checkPassword = require('hibp-checker');

// Create a new rpc server for listening to TCL iRule calls.
var ilx = new f5.ILXServer();

ilx.addMethod('hibpCheck', function(req, res) {
    var password = req.params()[0];
    
    var breachCount = checkPassword(password);
    
    breachCount.then(function(result) {
        return res.reply(result);
    }, function(err) {
        return res.reply(err);
    });

});

// Start listening for ILX::call and ILX::notify events.
ilx.listen();

Tested this on version: