[2143] in Kerberos
Re: New User Accounts
daemon@ATHENA.MIT.EDU (dean@ksr.com)
Wed Sep 2 12:53:44 1992
Date: Wed, 2 Sep 1992 12:30:16 -0400
From: dean@ksr.com
To: ramus@nersc.gov (Joe Ramus)
Cc: kerberos@Athena.MIT.EDU
For kerberos and non-kerberos systems, I assign users an initial
password and tell them what it is. They are told to change it (how
to change it, etc).
If they do not change it (ie, the old one can be used to change their
passwd, their passwd is changed and they lose.
--Dean
P.S. Has anyone had any experience using SecurID cards with Kerberos
IV or V?
I think one can use a service key to get a ticket and session key for
a mutually authenticated private session with a "kerberos-SecurID"
server, which is on the same machine as the kerberos server.
The SecurID code would be sent to this server, and if authenticated
by the SecurID software, the kerberos passwd would be changed to the
securID code, and then changed to something random 30 seconds later.
The client would get initial kerberos tickets as usual using the
SecurID code as the password.
Any comments are appreciated
