|
Size: 3459
Comment:
|
Size: 4409
Comment:
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 14: | Line 14: |
| * your DoC Kerberos password if you have one - until 2007, people were setup with a DoC kerberos password when they joined DoC. Since 2007, we don't create a separate DoC kerberos password for DoC users unless there is a special reason. | * your DoC Kerberos password (if you've been at DoC for at least 5 years, and if your doc password was not been deactivated (for instance, in Feb 2011). |
| Line 17: | Line 17: |
| [[https://www.imperial.ac.uk/spectrum/ict/services/security/passwords/change/external/default.aspx|ICT's password change webpage]] | [[https://www.imperial.ac.uk/ict/passwords/|ICT's password change webpage]] |
| Line 20: | Line 20: |
| So usually, your College and Windows passwords will be the same. | So usually, your College and DoC Windows passwords will be the same. |
| Line 37: | Line 37: |
| kinit xyz09@IC.AC.UK | kinit xyz13@IC.AC.UK |
| Line 40: | Line 40: |
| [if your username is xyz09]. | [if your username is xyz13]. |
| Line 42: | Line 42: |
| Note that "IC.AC.UK" must be written in upper case as shown, it's not an email address, it's a Kerberos realm. | Note that "IC.AC.UK" must be written in upper case as shown, it's not an email address, it's a Kerberos realm. If you're having trouble logging in to any service, this is a really good test command to run, as it provides specific error messages in the event that something unusual has happened, such as your account being locked. |
| Line 46: | Line 46: |
| Assuming that you know your current College password, either: | Assuming that you know your current College password, you can change your College password either by: |
| Line 48: | Line 48: |
| * [[https://www.imperial.ac.uk/spectrum/ict/services/security/passwords/change/external/default.aspx|This ICT webpage]] | * [[https://www.imperial.ac.uk/ict/passwords|This ICT webpage]] |
| Line 52: | Line 52: |
| kpasswd xyz09@IC.AC.UK | kpasswd xyz13@IC.AC.UK |
| Line 54: | Line 54: |
Please note that College passwords must be changed at least once a year, if you receive an email saying you need to change your College password in the next few days, take it seriously and do so. Do not ignore it or your account will get locked out and you will need to visit the ICT Service Desk in person to get it unlocked. == Changing your DoC Kerberos password == If you still have a vestigial DoC Kerberos password set, you can change it from the Linux command line: {{{ kpasswd abc02@DOC.IC.AC.UK }}} == Changing your DoC super-user password == If you have been granted super-user access to a machine, you will have a 'root principal' with a different password to your main accounts. You can change it from the Linux command line: {{{ kpasswd xyz13/root@DOC.IC.AC.UK }}} == Changing your DoC Windows password == Assuming that you know your current password, either: * Log in, press CTRL-ALT-DELETE, and select 'Change password'. * from the Linux command line: {{{ kpasswd xyz13@WIN.DOC.IC.AC.UK }}} == If you can't remember your password == |
|
| Line 57: | Line 89: |
| * come to CSG (room 225 Huxley) with your swipe card and ask us to let you change your College password. * go to the ICT service desk (level 4, Sherfield) and ask the same. |
* come to CSG (room 225 Huxley) with your swipe card and ask us to let you change it. * go to the ICT service desk (level 4, Sherfield) and ask the same. |
| Line 62: | Line 94: |
| Please note that College passwords must be changed at least once a year, if you receive an email saying you need to change your College password in the next few days, take it seriously and do so. Do not ignore it or your account will get locked out and you will need to visit the ICT Service Desk in person to get it unlocked. |
If you can't remember one of your DoC passwords, come to CSG (room 225 Huxley) with your swipe card and ask to let you change it. |
Authentication: Passwords
Single Sign On (Kerberos)
We are aiming towards a single College password for each user, that allows you to access all standard university and Departmental services, such as email, remote login and web services. Currently, all CSG-maintained Linux systems in the Department will accept
EITHER:
your College password (actually a Kerberos password stored in the College Active Directory domain),
OR
- your DoC Kerberos password (if you've been at DoC for at least 5 years, and if your doc password was not been deactivated (for instance, in Feb 2011).
DoC Windows machines currently use their own separately-stored passwords - however changing your College password via ICT's password change webpage attempts to also set your DoC Windows password.
So usually, your College and DoC Windows passwords will be the same. Sometimes the synchronization fails (we're working on this), and you may need to manually change your DoC Windows password to the same as your College password.
Kerberos also provides the ability to use ticket-based automatic single sign-on across services that have been extended to support it. When you login to (or unlock a locked session on) a DoC Linux machine, you receive a Kerberos ticket that lasts 8 hours. All the following services will try your current ticket rather than asking you for your password again until your ticket expires after 8 hours:
- Remote login via Secure Shell (SSH);
- Departmental web pages accessed over HTTPS from Kerberos-aware browsers like Firefox;
- Network filesystem access via Windows Networking (SMB/CIFS) - but this uses your DoC Windows AD/Kerberos ticket.
When your ticket has expired, you can give yourself another ticket from the College Kerberos/AD servers either by screen locking and unlocking your Linux session, or via the Linux command:
kinit xyz13@IC.AC.UK
[if your username is xyz13].
Note that "IC.AC.UK" must be written in upper case as shown, it's not an email address, it's a Kerberos realm. If you're having trouble logging in to any service, this is a really good test command to run, as it provides specific error messages in the event that something unusual has happened, such as your account being locked.
Changing your College Password
Assuming that you know your current College password, you can change your College password either by:
- from the Linux command line:
kpasswd xyz13@IC.AC.UK
Please note that College passwords must be changed at least once a year, if you receive an email saying you need to change your College password in the next few days, take it seriously and do so. Do not ignore it or your account will get locked out and you will need to visit the ICT Service Desk in person to get it unlocked.
Changing your DoC Kerberos password
If you still have a vestigial DoC Kerberos password set, you can change it from the Linux command line:
kpasswd abc02@DOC.IC.AC.UK
Changing your DoC super-user password
If you have been granted super-user access to a machine, you will have a 'root principal' with a different password to your main accounts. You can change it from the Linux command line:
kpasswd xyz13/root@DOC.IC.AC.UK
Changing your DoC Windows password
Assuming that you know your current password, either:
- Log in, press CTRL-ALT-DELETE, and select 'Change password'.
- from the Linux command line:
kpasswd xyz13@WIN.DOC.IC.AC.UK
If you can't remember your password
If you can't remember your College password, choose from these options:
- come to CSG (room 225 Huxley) with your swipe card and ask us to let you change it.
- go to the ICT service desk (level 4, Sherfield) and ask the same.
email service.desk@imperial.ac.uk (eg. when abroad) and plead insanity. provide sensible info, eg. your username, your CID and they'll usually take pity on you..
- contact the ICT service desk on x49000 (i.e. 0207 594 9000) and plead insanity again.
If you can't remember one of your DoC passwords, come to CSG (room 225 Huxley) with your swipe card and ask to let you change it.