In cells that use an AFS-modified login utility, the password is the same for both logging in and authenticating with AFS. In this case, you use a single command, kpasswd, to change the password.
If your machine does not use an AFS-modified login utility, there are separate passwords for logging into the local file system and authenticating with AFS. (The two passwords can be the same or different, at your discretion.) In this case, use the kpasswd command to change your AFS password and the UNIX passwd command to change your UNIX password.
Your system administrator can improve cell security by configuring several features that guide your choice of password. Keep them in mind when you issue the kpasswd command:
Limiting the amount of time your password is valid. This improves your cell's security by limiting the amount of time an unauthorized user has to try to guess your password. Your system administrator needs to tell you when your password is due to expire so that you can change it in time. The administrator can configure the AFS-modified login utility to report this information automatically each time you log in. You can also use the kas examine command to display the password expiration date, as instructed in To Display Password Expiration Date and Reuse Policy.
You can change your password prior to the expiration date, but your system administrator can choose to set a minimum time between password changes. The following message indicates that the minimum time has not yet passed.
kpasswd: password was not changed because you changed it too recently; see your system administrator
Enforcing password quality standards, such as a minimum length or inclusion of nonalphabetic characters. The administrator needs to tell you about such requirements so that you do not waste time picking unacceptable passwords.
Rejecting a password that is too similar to the last 20 passwords you used. You can use the kas examine command to check whether this policy applies to you, as instructed in To Display Password Expiration Date and Reuse Policy. The following message indicates that the password you have chosen is too similar to a previous password.
kpasswd: Password was not changed because it seems like a reused password
Issue the kas examine command to display your password expiration date and reuse policy. You can examine only your own account. The third line of the output reports your password's expiration date. The last line reports the password reuse policy that applies to you.
% kas examineyour_username
Password foryour_username
:your_AFS_password
The following example displays the output for the user pat.
User data for pat key (15) cksum is 3414844392, last cpw: Thu Oct 21 16:05:44 1999 password will expire: Fri Nov 26 20:44:36 1999 9 consecutive unsuccessful authentications are permitted. The lock time for this user is 25.5 minutes. User is not locked. entry never expires. Max ticket lifetime 100.00 hours. last mod on Wed Aug 18 08:22:29 1999 by admin don't permit password reuse
Issue the kpasswd command, which prompts you to provide your old and new passwords and to confirm the new password. The passwords do not echo visibly on the screen.
% kpasswd Old password:current_password
New password (RETURN to abort):new_password
Retype new password:new_password
Issue the UNIX passwd command, which prompts you to provide your old and new passwords and to confirm the new password. The passwords do not echo visibly on the screen. On many machines, the passwd resides in the /bin directory, and you possibly need to type the complete pathname.
% passwd Changing password forusername
. Old password:current_password
New password:new_password
Retype new passwd:new_password