How to use kpasswd to change Fermi domain, Services or Kerberos passwords

How to use kpasswd to change Fermi domain, Services or Kerberos passwords

Intended for:

Users who wish to use the kpasswd command to reset their Fermi domain (Windows log on), Services or Kerberos passwords. This is another option for users who need to reset their password and is done by command line (in a terminal for Mac/Linux or for a Windows command prompt:

Other options for resetting passwords include:

• Password Reset Tool (for Fermi domain and Services accounts only; requires an RSA token, YubiKey, CILogon certificate or Kerberos ticket to access.).  This will allow you the convenience of changing your password now and at any point in the future, 24x7, without having to contact the Service Desk. 
• Contacting the Service Desk.
• For employees who need to reset their Windows logon (Fermi domain) password, they can  press Ctrl + Alt + Delete and click "Change a password..." You must know your password for this option.

Scenario/Use case:

Reset Services, Fermi domain (Windows log on) or Kerberos password. 

Before you begin:

To use kpasswd, you must meet the following requirements:

• You must be connected to the lab network (onsite or via VPN) to reset your Fermi domain (Windows log on) and Services passwords. (Kerberos accounts can be reset offsite)
• You must know your old password. If you do not know your old password, you must contact the Service Desk.
• You must follow the password complexity requirements (see bottom of article)
• For Windows computers, you must install MIT Kerberos (Fermilab or personally owned)

Instructions:

When connected to the Fermilab network (onsite or via VPN) on a Fermilab-owned computer or device:

1. Open a terminal window:
   
   1. Mac users: open terminal
   2. Windows users: open command prompt
   3. Linux users: if using GUI, open terminal; if not, type the command
      
      
2. Pick the appropriate domain and type the associated command:
   
   1. Fermi
                  kpasswd username@FERMI.WIN.FNAL.GOV

1. 2. Services

kpasswd username@SERVICES.FNAL.GOV

2. 3. Kerberos

kpasswd username@FNAL.GOV

3. Enter your current password. If you do not know your current password, contact the Service Desk.
   
   
4. Enter your new password following the password requirements (see bottom of article).

When connected to the Fermilab network on a non-FERMI computer:

1. Install the krb5.conf file on your computer (Linux and Mac computers only).
   
2. Open a terminal window:

1. • Mac users: open terminal
   • Windows users: open command prompt
   • Linux users: if using GUI, open terminal; if not, type the command.
     
     

3. Pick the appropriate domain and type in the associated command:

3. 1. Fermi
                  kpasswd username@FERMI.WIN.FNAL.GOV

4. 2. Services

kpasswd username@SERVICES.FNAL.GOV

5. 3. Kerberos

kpasswd username@FNAL.GOV

4. Enter in your current password. If you do not know your current password, contact the Service Desk.
   
   
5. Enter your new password following the password requirements (see bottom of article)

When not connected to the Fermilab network or if you are using a non-Fermilab-owned computer:

1. Install the Fermilab VPN software.
   
   
2. Install the krb5.conf file on your computer ( Linux and Mac only).
   
3. Open a terminal window

• Mac users: open terminal
• Windows users: open command prompt
• Linux users: if using GUI, open terminal; if not, type in the command
  
  

4. Pick the appropriate domain domain and type in the associated command:

1. 1. Fermi

kpasswd username@FERMI.WIN.FNAL.GOV

2. 2. Services

kpasswd username@SERVICES.FNAL.GOV

3. 3. Kerberos

kpasswd username@FNAL.GOV

5. Enter your current password. If you do not know your current password, contact the Service Desk.
   
   
6. Enter your new password following the password requirements (at bottom of article)

Password Requirements:

1. 1. Minimum of 10 characters
   2. Three of the four character groups must be used 

1. 1. 1. Uppercase
      2. Lowercase
      3. Numeric
      4. Special characters ( !,%,#, and @ are supported )

1. 1. The password cannot contain three or more characters from your username
   2. You cannot reuse any of your last 8 passwords
   3. Your password cannot contain your username or real name
   4. The password has a minimum age of 2 days