Questions tagged [password-management]

Procedures, policies and constraints on password entry, lifetime, change, strength, and storage. An essential part of access management, together with policies on other forms of authentication.

Filter by
Sorted by
Tagged with
1
vote
0answers
43 views

Can you display/change a message on the Windows 10 “change password” screen?

Does anyone know if it is possible to change the error messages displayed to users when changing their password? Specifically the complexity requires message. If possible I would like to change it to ...
0
votes
2answers
65 views

How can users change their Active Directory password without Remote Desktop?

In our Active Directory setup, some users will be accessing domain resources (shared folders on the network, specifically) from non-domain computers. Only users from the domain have permission to ...
1
vote
1answer
61 views

Windows Server: Let users change their password remotely without RDP in non domain setup

So what do we have: Windows Server 2019 as file server in a non-domain setup. Users should be able to change their password remotely from their client PCs without requiring the IT-support. What we've ...
0
votes
0answers
49 views

`pass` not asking for password anymore - gnome-keyring or gpg-agent related? How can I force password asking?

I have gnome-keyring running for sure, not sure it's gnome-keyring or gpg-agent or ssh-agent related... I use pass as command line password manager for many things. Usually, when querying pass, a ...
0
votes
0answers
157 views

Default Domain Policy not applying Password Policy, red x on the policy

This is the screenshot of RSOP.msc digging into the password policies, on the client machine. Policy is being pulled but not applied? I tried going to the path but there was no winlogon.log. It ends ...
0
votes
0answers
7 views

With PowerShell how can i find where a password was changed. I know how to get when it was changed but i also want to know from where this was done

I can easily generate a report of when passwords were changed and when passwords soon need to be changed with PowerShell. For security auditing I would like to know where passwords are changed. Not at ...
0
votes
1answer
118 views

Password Synchronization between two forests or in one forest; using replication or using MIM to synchronize?

So we have got a domain (e.g. contoso.local) which is replicated over 4 DCs. All DCs are in the same Subnet. All users reside in the same OU in this one domain. All Workstations are in their own OU as ...
0
votes
2answers
91 views

could a password policy be dynamic on windows with or without AD

On some windows server I would like to set different password complexity depending for exemple on the password length. Is it possible to make conditions, so I can have a high level of complexity with ...
0
votes
0answers
19 views

Can an Google Suite admin access passwords stored in Chrome by users?

I'm looking for password manager options for a small new startup. Chrome is a candidate due to the convenience and simplicity, but I couldn't find if there is a way to access passwords of other ...
1
vote
1answer
39 views

Bulk Device Management: Generating and storing the username & passwords for many Linux devices

I have a hundred Linux devices (Raspberry Pis) to provision. That includes generating new username/password pairs and storing them for future use. Once they are deployed in the field, I'll need to ...
0
votes
1answer
53 views

Azure-only banned password list in a hybrid AD environment

I'm currently researching how to set up a banned password list in Active Directory. I'm doing this in a hybrid environment. Unfortunately, right now we're only licensed for Azure AD Free, which is ...
3
votes
2answers
366 views

Lock user account in LDAP (without using ppolicy)

In this answer, is was suggested that the UNIX way of adding a ! in front of the password field would work. I claim that this is not a clean solution. It will not make logins impossible, but merely it ...
1
vote
1answer
57 views

Can a user that is not in the Administrators group change the password on a command line

Is it possible for a user that is not in the Administrators group to change his or her domain password in a coommand line, that is, without using ctrl-alt-delete? It seems to me that this is not ...
0
votes
1answer
689 views

How to configure password synchronization between two Active Directory Domains with Microsoft Identity Manager PCNS?

I have two domains with a two-ways trust relationship (selective authentication). Microsoft Identity Manager is installed, configured and "Password Change Notification Service" is configured and ...
1
vote
0answers
96 views

How do I input passwords for mysql config editor inside of a dockerfile

Is there a way to create a docker image that needs to use the mysql_config_editor set command with a password without putting the password in the dockerfile and without manually inputting it later in ...
0
votes
2answers
388 views

Active Directory password change: Re-Allow current password?

My question is that simple: Can I configure an active directory in a way that when a user wants/needs to change his password, his current one isn't forbidden (if it's in compliance with the current ...
4
votes
1answer
3k views

can I reset the clock on an expired password in AD?

I have a customer who's users all access the solution via RDP and whom are all set to 'password never expires' in AD. We're enforcing a password expiration policy and introducing a self-serve ...
0
votes
1answer
135 views

How to add pre-hashed password to ejabberd with ansible

I know that I can add users using the ansible ejabberd_user module, but there doesn't seem to be a way to add a user with a pre-hashed password. I want this: - name: create a user if it does not ...
0
votes
1answer
39 views

Is there a way to set up passwordless / passphraseless ssh so can only come from one client?

I know how to set up passwordless / passphraseless ssh. But my understanding is that setting it up that way means that if someone get ahold of the id_dsa file, they can then log in from any machine. ...
0
votes
1answer
3k views

Enable Password Policy in OpenLDAP 2.4.44

I am trying to enable user password policies in my OpenLDAP 2.4.44 instance based on the osixia/docker-openldap Docker image. Basically, following this description, I have set up following structure ...
1
vote
1answer
708 views

Automated SFTP transfer using WinSCP - how safe is it to store credentials in Windows environment variables?

I've had to implement an automated SFTP file transfer which requires a username and password. Not wanting to leave the password in a text file / batch script for the world to stumble across, I've ...
4
votes
3answers
790 views

How does “your new password must differ at least n characters from the previous” work when only hash codes are stored?

I am wondering how the password policy "your new password must differ at least n characters from your old password" works. My understanding is that the OS never actually stores the old passwords ...
0
votes
1answer
947 views

How to hide the java keystore password in keytool scripts

As part of our project, we are pushing in the SSL certificates onto the rich clients which try to establish the connection with SSL based web servers through a windows batch script. This script ...
-1
votes
1answer
51 views

How do you stop a hacker from changing passwords in your DB directly, if they're already in a position to steal the DB? [closed]

I've been researching the methods of securely storing user passwords in a database (by only storing the hashed password, with a strong algorithm, along with a salt, and deriving the key after so many ...
2
votes
0answers
1k views

SSH disconnects on changing expired password

I enabled password expiration on my Debian 8 server and today my password expired. When I login through SSH, the server forces me to change my password now. I had to enter the old password, specify a ...
1
vote
2answers
3k views

Postfix/Dovecot and new password protected private key

I've created a CST and private key pair, as said by StartSSL, for my postfix/dovecot Ubuntu 14.04 server, with: openssl req -newkey rsa:2048 -keyout mydomain.key -out mydomain.csr On the passphrase ...
5
votes
1answer
821 views

How do I secure the access token, on Linux, to remote, automated secrets stores like Hashicorp Vault?

There seems to be a bit of a "chicken and egg" problem with the passwords to the password managers like Hashicorp Vault for Linux. While researching this for some Linux servers, someone clever asked, ...
1
vote
2answers
430 views

Users can't change passwords from workstations or OWA

Users on workstations or email users using OWA can't change passwords. Passwords can be set using Active Directory Users & Computers. Win2008 R1 32bit domain controller. Win7 Pro desktops. ...
4
votes
2answers
5k views

Disable password complexity on Windows 2012 R2

I have a Windows Server 2012 R2 that is my domain controller. I want to disable the password complexity rule for a few users only. I have created a group (called Formation) in AD to identify these ...
4
votes
1answer
2k views

The password on this account cannot be changed at this time?

A user in my company forgot his password and I had to reset it to a temporary one. I checked the box that says "User Must Change Password at Next Logon". When he logged on and entered the temporary ...
1
vote
1answer
1k views

How to automate FTP user password updates, on a remote IBM z/OS FTP server?

We wish to solve the business problem of how to schedule automated password updates, on a remote FTP server (note: z/OS) over which we have no administrative control, before the password expires. For ...
0
votes
0answers
105 views

Active Directory password policy for Business Days?

I don't think there's any way to do this after looking through Microsoft's password policy documentation, but on the off-chance that someone was particularly clever: Is it possible to create a policy ...
0
votes
1answer
34 views

Do “Old Passwords” have an expiration?

There are some systems that keep track of "old passwords" for increased security, like Databases, Domain Controllers, personal pages (Like Facebook) etc. Do these "old passwords" have an expiration? ...
3
votes
1answer
2k views

Allow self password change using LDAP(s) with Samba4

I am trying to create a webapp to allow users to change their own passwords in Samba4 (perhaps, also in AD), using LDAP(s). But when I try to modify the user password using this code: dn: ........ ...
5
votes
4answers
3k views

Kerberos with OpenLDAP backend: Password Sync HowTo

The basic setup is an OpenLDAP server. The users are provisioned and the passwords are set. Now we decided to add an MIT KDC for being able to use Kerberos. We configured the MIT KDC to utilize the ...
3
votes
2answers
5k views

Forced to change expired password when using ssh key

I am working in an environment where I have an account on multiple linux machines where accounts and passwords are managed independently (no active directory/LDAP/etc) and passwords expire every 30 ...
0
votes
1answer
94 views

Konica Bizhub Photocopier - Change Pin

We have a Konica Bizhub Photocopier. When we use the device, we have to enter the pin/password: 1135. I also have to use this pin when I authenticate a user account so they can print over the network. ...
0
votes
1answer
23 views

Logging or Auditing functionality for un/successful access to password hash files and other authentication files on Windows Server 2008 R2

I have been asked to find whether there is auditing enabled for one of our Windows Servers for accessing password hash files or other files used for authentication. Does anyone know if there is a ...
2
votes
1answer
7k views

Postfix + Dovecot with MySQL backend: md5-hashed passwords and CRAM-MD5 auth

My question What are the risks of switching from MD5 to CRAM-MD5 passwords in the database, especially considering the following, and how to approach that for an existing installation (provided I ...
1
vote
1answer
44 views

How can I automate the retrieval and usage of passwords from within a script?

We have automated scripts that access certain devices and are getting the passwords for the devices from a root-read-only plain-text file. Is there some kind of architecture we can use so that we can ...
4
votes
2answers
120 views

AD | Prevent admins from changing passwords to the same thing

I have an interesting security problem: Admins with ad access have been changing their password to the same thing, and breaching the company security policy. User side, standard AD complicated ...
4
votes
2answers
1k views

Is there a way to change passwords on multiple servers simultaneously?

x3 Server 2012 R2, x2 Server 2012 My system has 5 servers; 1 Hyper-V server hosting 2 vm servers (these are the x3 2012 R2 servers), and a Win 8.1 pc running hyper-V that hosts 2 more vm servers (...
2
votes
3answers
9k views

Unable to change domain password even if the password is complex

I have a problem with users not being able to change their passwords. When they try to change the password, they get this error: "Your new password does not meet the length, complexity, or history ...
1
vote
1answer
630 views

How to change Account Lockout Threshold when the path cannot be found

I am trying to change the account lockout threshold for all the users on our domain. The threshold should be three, but there are users who get locked out after one mistyped password, and others who ...
-1
votes
1answer
91 views

IT for a small organization: mailing lists, file server, hosting [closed]

I've been asked to help manage my church's information systems. We're small (~3 staff, ~150 parishioners), which puts us below the needs of a lot of the "Church Management" software I've seen. The ...
1
vote
1answer
1k views

Cannot enforce password change in OpenLDAP with Password Policy Overlay

I've implemented Password Policy Overlay on OpenLDAP on Debian Stable. The server side and the policies are working as expected. However, after expiration I cannot force users to change their ...
1
vote
2answers
617 views

How to store admin passwords in a way that can be accessed by multiple admins? [closed]

How to store all the admin passwords for routers, servers, desktop computers in the network if they need to be accessible by multiple admins? There are so many that they can't be memorised and they ...
3
votes
1answer
865 views

Forcing a password change on OpenBSD

On OpenBSD 5.6 I need to provision a number of user accounts with default passwords. I would like users, upon their first SSH login, to be forced to change their passwords from the default. On CentOS ...
16
votes
3answers
6k views

Is there a safe way to store passwords used for ssh by a script?

So first, I know, I should use key auth with SSH. No need to explain me that. Issue here is that I have a (big) bunch of servers, and I need to have a script be able to connect each of these. I use ...
-5
votes
1answer
90 views

Is 10 character (letters and numbers mixed) password strong enough for Internet Servers? [closed]

Assuming ssh brute force attacks. Assuming the following IPTABLES configuration: DROP tcp -- anywhere anywhere tcp dpt:ssh state NEW recent: UPDATE seconds: 120 ...