Last modified: Apr 11, 2008 by Kachelhoffer

AFS: modification of the password

1. Modification of the password by the user

The Unix command password is not used and any modification of the UNIX password by the ypasswd or passwd has no effect. You should use the AFS command kpasswd to be able to modify your password.

> kpasswd
Changing password for ‘mirabito' in cell ‘in2p3.fr'.
Old password:
Give the old one and the new one will be requested twice.

For security reasons, it is strongly recomendated to change periodically your password. The Computing Center has put a password validation limit of six month, but you can be more secure ! At Computing Center, the following rules are applied to the passwords:

• A password not changed after 180 days will be automatically invalidated by Kerberos. It will not be possible to connect to the interactive cluster. A new password could be given only by a password administrator (or CZAR).
• A password not changed until 120 days (but less than 180) should be changed at the first session after this delay. At each connection in the 10 days before the validation term, the user will be asked to change its password by the following message:

  ATTENTION: Your PASSWORD EXPIRES in 5 days!

  In this case, you should immediatly change your password with the kpasswd command.

For having the names of the persons who has the right to give or change your password, you should use the anq setpw command as:

> anq setpw [username]

For having the number of days before expiration of your password, you should use the anq pw command that gives you this number:

> anq pw

It is recomendated to control this number of days before going on holidays or long time mission in order to avoid to have a non validated password on return.

2. Modification of a user password by an adminisrator

In general, the person who have the rights to modify or notify a password to a user is not hte same as whom is responsible of the AFS group space. In order to know who have the priviledges to modify your password (if you are connected), type:

> anq setpw

which display the list of accounts which have the rights to modify your password. These accounts should use the setkpasswd username command in order to set up your new password as:

> setkpasswd username