1

We have a "master" server running Suse Enterprise with LDAP that controls user's access to our systems. We want to implement a 90 day expiration policy, but the issue is that most of our servers are accessed via HTTPS by end users who are not technical. They won't know how to ssh in and run "passwd" before their passwords expire.

I'm concerned that once their passwords expire, they'll need to come to me. Is there a way to force them to change their passwords once they're expired if they're logging in to our SVN or Jira via HTTPS?

0

Basic and digest authentication basically works by requiring a valid username/password to access a page, giving the browser a 401 unauthorized the first time the it tries to get the page. When your browser realizes it needs a password to get in it prompts the user for what password to give the web server. So there's no real opportunity to do what you're wanting that way. All the browser knows is "I give the web server a username/password and it starts returning success."

I don't know what SuSE uses for LDAP but if you're using FreeIPA there are typically self-service options that you can look into, with password management being one of them. You can also send out an email to users just prior to their password expiration directing them either to FreeIPA or some other homegrown web application for self-service.

  • Suse uses OpenLDAP. We're going to have to draft up a procedure to show people how to SSH in and change their passwords to try and alleviate the admin time required. Sounds easy, but most of these people don't even know what SSH is! Thank you for the thorough answer. I would vote you up, but I don't have enough reputation yet! – Mike Thoma Apr 20 '15 at 13:50
  • I was able to find this which looks promising if you were interested in creating a self-service website. – Bratchley Apr 20 '15 at 16:33
  • This looks great. I will propose it to my Director of Security. Thanks a million. – Mike Thoma Apr 21 '15 at 18:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.