Questions tagged [password-management]
Procedures, policies and constraints on password entry, lifetime, change, strength, and storage. An essential part of access management, together with policies on other forms of authentication.
160
questions
0
votes
0
answers
28
views
New LAPS - Authorized password decryptor not updating permissions as expected
Created a new group DOMAIN\LapsAdmins. Currently empty.
Configured GPO Configure Authorized password decryptors to point to my group DOMAIN\LapsAdmins
Forced server1 to create a new encrypted password ...
- 270
0
votes
0
answers
116
views
Storing Hashed Passwords for Docker and Docker Compose
What is the best way to store passwords and use them in Dockerfile and docker-compose.yaml. Can I store the secrets in a hashed format and make use of it, So that no one can read my real passwords ...
- 11
0
votes
1
answer
372
views
Can the Maximum machine account password age be set differently for one OU on a domain controller
In my organization, when we provision a computer one of the steps includes joining our domain. Typically we provision one pc at a time as the need comes up. I would like to get out of this habit and ...
0
votes
1
answer
573
views
vaultwarden on a public IP - is it worth to restrict to VPN only?
I feel a bit embarrassed to ask this, because I am not able to figure it out myself.
I run a vaultwarden instance (open source bitwarden) on a public VPS on the open Internet. It is properly set up ...
- 499
1
vote
1
answer
523
views
LAPS Update-AdmPwdADSchema doesn't add the attributes
So I've installed LAPS according to THIS article. I've done this on 3 domains so far with great success but on the 4th one, for some reason, the attributes ms-Mcs-AdmPwd and ms-Mcs-...
- 85
0
votes
0
answers
218
views
Saving ssh password with password manager
I am a user of a server with 2 level password authentication (keys+password). My passphrase for the keys is stored in the mac OS keyring app, but I cannot find a way to save my password.
I have read ...
- 109
1
vote
2
answers
2k
views
How can I set the 'password last set' date of an AD account?
In a development environment I want to modify the 'password last set' date of my AD accounts so they won't begin to expire during development phase, but as soon as the environment becomes a production ...
- 616
2
votes
0
answers
3k
views
OpenVPN - How to suppress WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
In OpenVPN GUI, I am getting the red message
WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this.
I do not want to always re-type my password ...
- 210
0
votes
1
answer
2k
views
Change Windows PIN requirements in Intune for an Azure AD-joined PC
I am the part-time admin of a small nonprofit, with a Microsoft 365 Business Premium subscription. I have been searching through admin.microsoft.com and portal.azure.com, but can't seem to find the ...
- 314
1
vote
1
answer
170
views
How to notify administrators of an Active Directory pwd change?
I don't know much about AD or Windows security. As in this question, I understand that pwd change notification can be useful for both users and for system administrators.
As an AD administrator on ...
- 230
0
votes
0
answers
39
views
php config - generate hashed password manually
I've created a php conf file, which include some user / password infos. For testing purposes I've added the password for the database in plain text. Since this can't be a good idea, I want to change ...
- 21
2
votes
2
answers
2k
views
How to remove AdmPwd Permission from BUILTIN\Users (MS LAPS)
I've deployed MS LAPS to manage local admin passwords and all is working fine, except that non-privileged users are able to access the local admin password, in both Powershell and LAPS UI.
Running the ...
- 21
11
votes
2
answers
3k
views
Why does adding one character to my MySQL password lock me out?
I am able to log in via mysql -u myuser -p mydb -h localhost with this:
grant all privileges on mydb.* to myuser@'%' identified by
'...
- 221
0
votes
3
answers
2k
views
"Password never expires" greyed out?
I have domain users in an Azure AD DS.
I need to set some of those users with passwords that don't expire.
When I go to "Active Directory Users and Computers" on a machine in the domain, the ...
- 137
0
votes
0
answers
824
views
LAPS ms-Mcs-AdmPwd blank or null values
I am writing a script to export all computer LAPS ms-Mcs-AdmPwd values to KeePass to allow historical logging.
I have a few machines for whatever reason a few objects have no password set. However I ...
1
vote
0
answers
291
views
Can you display/change a message on the Windows 10 "change password" screen?
Does anyone know if it is possible to change the error messages displayed to users when changing their password? Specifically the complexity requires message. If possible I would like to change it to ...
- 353
1
vote
2
answers
3k
views
How can users change their Active Directory password without Remote Desktop?
In our Active Directory setup, some users will be accessing domain resources (shared folders on the network, specifically) from non-domain computers. Only users from the domain have permission to ...
- 203
1
vote
1
answer
1k
views
Windows Server: Let users change their password remotely without RDP in non domain setup
So what do we have: Windows Server 2019 as file server in a non-domain setup. Users should be able to change their password remotely from their client PCs without requiring the IT-support. What we've ...
- 307
0
votes
1
answer
468
views
Password Synchronization between two forests or in one forest; using replication or using MIM to synchronize?
So we have got a domain (e.g. contoso.local) which is replicated over 4 DCs. All DCs are in the same Subnet. All users reside in the same OU in this one domain. All Workstations are in their own OU as ...
- 5
0
votes
2
answers
237
views
could a password policy be dynamic on windows with or without AD
On some windows server I would like to set different password complexity depending for exemple on the password length.
Is it possible to make conditions, so I can have a high level of complexity with ...
- 446
1
vote
1
answer
54
views
Bulk Device Management: Generating and storing the username & passwords for many Linux devices
I have a hundred Linux devices (Raspberry Pis) to provision. That includes generating new username/password pairs and storing them for future use. Once they are deployed in the field, I'll need to ...
- 155
0
votes
1
answer
99
views
Azure-only banned password list in a hybrid AD environment
I'm currently researching how to set up a banned password list in Active Directory. I'm doing this in a hybrid environment. Unfortunately, right now we're only licensed for Azure AD Free, which is ...
4
votes
3
answers
2k
views
Lock user account in LDAP (without using ppolicy)
In this answer, is was suggested that the UNIX way of adding a ! in front of the password field would work. I claim that this is not a clean solution. It will not make logins impossible, but merely it ...
- 348
1
vote
1
answer
64
views
Can a user that is not in the Administrators group change the password on a command line
Is it possible for a user that is not in the Administrators group to change his or her domain password in a coommand line, that is, without using ctrl-alt-delete?
It seems to me that this is not ...
- 135
0
votes
1
answer
2k
views
How to configure password synchronization between two Active Directory Domains with Microsoft Identity Manager PCNS?
I have two domains with a two-ways trust relationship (selective authentication). Microsoft Identity Manager is installed, configured and "Password Change Notification Service" is configured and ...
- 103
1
vote
0
answers
174
views
How do I input passwords for mysql config editor inside of a dockerfile
Is there a way to create a docker image that needs to use the mysql_config_editor set command with a password without putting the password in the dockerfile and without manually inputting it later in ...
- 213
0
votes
2
answers
2k
views
Active Directory password change: Re-Allow current password?
My question is that simple:
Can I configure an active directory in a way that when a user wants/needs to change his password, his current one isn't forbidden (if it's in compliance with the current ...
- 121
4
votes
1
answer
5k
views
can I reset the clock on an expired password in AD?
I have a customer who's users all access the solution via RDP and whom are all set to 'password never expires' in AD.
We're enforcing a password expiration policy and introducing a self-serve ...
- 541
0
votes
1
answer
190
views
How to add pre-hashed password to ejabberd with ansible
I know that I can add users using the ansible ejabberd_user module, but there doesn't seem to be a way to add a user with a pre-hashed password.
I want this:
- name: create a user if it does not ...
- 123
0
votes
1
answer
48
views
Is there a way to set up passwordless / passphraseless ssh so can only come from one client?
I know how to set up passwordless / passphraseless ssh. But my understanding is that setting it up that way means that if someone get ahold of the id_dsa file, they can then log in from any machine.
...
- 281
0
votes
1
answer
4k
views
Enable Password Policy in OpenLDAP 2.4.44
I am trying to enable user password policies in my OpenLDAP 2.4.44 instance based on the osixia/docker-openldap Docker image.
Basically, following this description, I have set up following structure ...
0
votes
1
answer
1k
views
Automated SFTP transfer using WinSCP - how safe is it to store credentials in Windows environment variables?
I've had to implement an automated SFTP file transfer which requires a username and password.
Not wanting to leave the password in a text file / batch script for the world to stumble across, I've ...
- 121
4
votes
3
answers
2k
views
How does "your new password must differ at least n characters from the previous" work when only hash codes are stored?
I am wondering how the password policy "your new password must differ at least n characters from your old password" works.
My understanding is that the OS never actually stores the old passwords ...
- 210
0
votes
1
answer
1k
views
How to hide the java keystore password in keytool scripts
As part of our project, we are pushing in the SSL certificates onto the rich clients which try to establish the connection with SSL based web servers through a windows batch script.
This script ...
- 123
-1
votes
1
answer
57
views
How do you stop a hacker from changing passwords in your DB directly, if they're already in a position to steal the DB? [closed]
I've been researching the methods of securely storing user passwords in a database (by only storing the hashed password, with a strong algorithm, along with a salt, and deriving the key after so many ...
- 159
2
votes
0
answers
2k
views
SSH disconnects on changing expired password
I enabled password expiration on my Debian 8 server and today my password expired.
When I login through SSH, the server forces me to change my password now. I had to enter the old password, specify a ...
1
vote
2
answers
5k
views
Postfix/Dovecot and new password protected private key
I've created a CST and private key pair, as said by StartSSL, for my postfix/dovecot Ubuntu 14.04 server, with:
openssl req -newkey rsa:2048 -keyout mydomain.key -out mydomain.csr
On the passphrase ...
- 499
6
votes
1
answer
2k
views
How do I secure the access token, on Linux, to remote, automated secrets stores like Hashicorp Vault?
There seems to be a bit of a "chicken and egg" problem with the passwords to the password managers like Hashicorp Vault for Linux.
While researching this for some Linux servers, someone clever asked, ...
- 341
1
vote
2
answers
572
views
Users can't change passwords from workstations or OWA
Users on workstations or email users using OWA can't change passwords. Passwords can be set using Active Directory Users & Computers.
Win2008 R1 32bit domain controller.
Win7 Pro desktops.
...
- 11
4
votes
2
answers
5k
views
Disable password complexity on Windows 2012 R2
I have a Windows Server 2012 R2 that is my domain controller. I want to disable the password complexity rule for a few users only.
I have created a group (called Formation) in AD to identify these ...
- 155
4
votes
1
answer
6k
views
The password on this account cannot be changed at this time?
A user in my company forgot his password and I had to reset it to a temporary one. I checked the box that says "User Must Change Password at Next Logon".
When he logged on and entered the temporary ...
- 6,970
1
vote
1
answer
2k
views
How to automate FTP user password updates, on a remote IBM z/OS FTP server?
We wish to solve the business problem of how to schedule automated password updates, on a remote FTP server (note: z/OS) over which we have no administrative control, before the password expires. For ...
- 274
0
votes
0
answers
141
views
Active Directory password policy for Business Days?
I don't think there's any way to do this after looking through Microsoft's password policy documentation, but on the off-chance that someone was particularly clever:
Is it possible to create a policy ...
- 1,196
0
votes
1
answer
39
views
Do "Old Passwords" have an expiration?
There are some systems that keep track of "old passwords" for increased security, like Databases, Domain Controllers, personal pages (Like Facebook) etc.
Do these "old passwords" have an expiration? ...
- 111
3
votes
1
answer
3k
views
Allow self password change using LDAP(s) with Samba4
I am trying to create a webapp to allow users to change their own passwords in Samba4 (perhaps, also in AD), using LDAP(s). But when I try to modify the user password using this code:
dn: ........
...
- 161
5
votes
4
answers
4k
views
Kerberos with OpenLDAP backend: Password Sync HowTo
The basic setup is an OpenLDAP server. The users are provisioned and the passwords are set.
Now we decided to add an MIT KDC for being able to use Kerberos. We configured the MIT KDC to utilize the ...
- 51
6
votes
2
answers
17k
views
Forced to change expired password when using ssh key
I am working in an environment where I have an account on multiple linux machines where accounts and passwords are managed independently (no active directory/LDAP/etc) and passwords expire every 30 ...
- 291
0
votes
1
answer
114
views
Konica Bizhub Photocopier - Change Pin
We have a Konica Bizhub Photocopier. When we use the device, we have to enter the pin/password: 1135. I also have to use this pin when I authenticate a user account so they can print over the network.
...
- 213
0
votes
1
answer
26
views
Logging or Auditing functionality for un/successful access to password hash files and other authentication files on Windows Server 2008 R2
I have been asked to find whether there is auditing enabled for one of our Windows Servers for accessing password hash files or other files used for authentication.
Does anyone know if there is a ...
- 133
2
votes
2
answers
11k
views
Postfix + Dovecot with MySQL backend: md5-hashed passwords and CRAM-MD5 auth
My question
What are the risks of switching from MD5 to CRAM-MD5 passwords in the database, especially considering the following, and how to approach that for an existing installation (provided I ...
- 349