Password resets

[itgeek]

Hi

 

Can anyone recommend a self service password reset for students as we use a number of different systems that link back to our local AD?

 

This would have to be web based we currently sync our local AD to Office365 so users have the same password for local AD and office365 account?

 

Thanks in advance

[thimon]

Do you use Foldr? That has a user password self reset service.

[itgeek]

No unfortunately we don't use Folr. Thanks for the reply

[psydii]

https://docs.microsoft.com/en-us/microsoft-365/admin/add-users/let-users-reset-passwords?view=o365-worldwide

 

Office 365 has this built in. You'll need Password Write Back in AzureAD Connect to be enabled.

[jmak]

https://docs.microsoft.com/en-us/microsoft-365/admin/add-users/let-users-reset-passwords?view=o365-worldwide

 

Office 365 has this built in. You'll need Password Write Back in AzureAD Connect to be enabled.

Just to be aware of: you need to subscribe to Azure AD Premium P1 is you want write back to on prem AD.

 

From the link above:

 

If you're using an on-premises Active Directory, the above two points don't apply. Rather, you can set this up butit requires a paid subscription to Azure AD Premium.

[/Quote]

[ITGURU]

I've jut setup a VM of LOGONBOX - Looks good but haven't rolled out yet, until done further testing. Should have had this setup before we closed, due to the number of students who cannot remember passwords!

FREE version is all i need.

[timbo343]

I've jut setup a VM of LOGONBOX - Looks good but haven't rolled out yet, until done further testing. Should have had this setup before we closed, due to the number of students who cannot remember passwords!

FREE version is all i need.

Would be interested to know how the free version works. Would you direct users to it or would you do it yourself and let the user know what the password is.

 

I looked at passcore but was put off by it as it looked like if you knew the username you could reset the password - not good!

[ITGURU]

Would be interested to know how the free version works. Would you direct users to it or would you do it yourself and let the user know what the password is.

 

I looked at passcore but was put off by it as it looked like if you knew the username you could reset the password - not good!

Free version allows you to set security questions. you point the users to the VM web interface. they enter their username and AD password. they then set their answers to the questions. In future when they visit the page they choose reset password enter their username answer x number of questions out of the total and if get correct cam enter new password and writes back to AD.

[timbo343]

Free version allows you to set security questions. you point the users to the VM web interface. they enter their username and AD password. they then set their answers to the questions. In future when they visit the page they choose reset password enter their username answer x number of questions out of the total and if get correct cam enter new password and writes back to AD.

 

Is it possible to tie it down to specific OUs / Groups. IE, i don't want it for staff - they usually remember their details, would rather roll this out for students only as it's them that seem to have the issue.

[psydii]

Good point, we've had p1 and now p2 for so long I forget the frustrations of A1. May I recommend getting a few A5 licences, they come with all sorts of tennant-wide benefits.

[ITGURU]

Is it possible to tie it down to specific OUs / Groups. IE, i don't want it for staff - they usually remember their details, would rather roll this out for students only as it's them that seem to have the issue.

Yes you choose which OUs you want to sync with.

[mavhc]

Would be interested to know how the free version works. Would you direct users to it or would you do it yourself and let the user know what the password is.

 

I looked at passcore but was put off by it as it looked like if you knew the username you could reset the password - not good!

 

Looking at passcore seems like you need to know the original password too.

 

Seems like as a school something that sent the change request to their tutor or similar would be best, that way they can check it was really requested by the right student

[timbo343]

Just coming back to LogonBox, is there a way to get a Let'sEncrypt Certificate on the VM?

[timbo343]

So i've found the page to start with Let's encrypt but it would seem i'm falling at the first hurdle - https://docs.logonbox.com/app/manpage/en/article/532466/Using-free-Let's-Encrypt-SSL-certificates

 

I don't know any commands of linux at all so i've hit a brick wall already.

 

 

 

[mavhc]

Is nano installed instead of Vi?

 

in vi you press escape, then :w to write, and :q to quit

 

maybe you should be root, su or sudo -s

[timbo343]

Is nano installed instead of Vi?

 

in vi you press escape, then :w to write, and :q to quit

 

maybe you should be root, su or sudo -s

 

I am in as root on the SSH and :w doesn't work, doesn't work and the key ESC just keeps giving me error sounds.

 

Think i'm going to sack it off as a bad job unless someone knows how to actually configure the let's encrypt cert. The LogonBox instructions to me don't work.

[mavhc]

what ssh client are you using?

[timbo343]

what ssh client are you using?

 

I'm using Putty

[EBrooke]

ManageEngine provides a tool for this.

https://www.manageengine.com/products/self-service-password/

[timbo343]

Thanks but it's only for 50 users.

[timbo343]

For anyone that decides to use Logon Box with Let's Encrypt, here are the instructions from Logon Box - do not follow the ones on their site.

 

You will need to add the feature first from Updates, Features & Licensing in the top right menu.

 

Let's Encrypt can be installed from the Security tab. Install that and restart the service.

 

 

 

After the restart you can go to the Certificates menu (located in the top left menu) and create a new certificate.

 

You should now be able to change the Certificate Provider to Lets Encrypt.

 

Fill in the rest of the cert details and click Create.

**Note that your LogonBox server needs to be externally accessible on port 80 HTTP for this to work as Let's Encrypt will attempt to make a connection to your LogonBox server to check for a file that gets created (the exception of this is if you are creating a wildcard cert, where you have to create an entry on your DNS servers).

 

 

Once it's created, you can then apply that certificate to the server by going to System Configuration in the top right menu, then Interfaces and editing the default HTTPS interface.

 

Go to the Protocol tab and set the certificate to your new one and click Update.

 

Now restart the service. Note that the web page will not auto-reload as it's going to be presenting a new cert, so give the server a couple of minutes to restart then hit refresh to get things going again with the new cert.

 

On the VM it's self, the service is under the "Cog" then look for LogonBox. Either click STOP, then START or click the Restart button next to Start/Stop - i couldn't find a way to restart any other way.

[ITGURU]

For anyone that decides to use Logon Box with Let's Encrypt, here are the instructions from Logon Box - do not follow the ones on their site.

 

 

 

On the VM it's self, the service is under the "Cog" then look for LogonBox. Either click STOP, then START or click the Restart button next to Start/Stop - i couldn't find a way to restart any other way.

 

Why does logon box need Port 80 opened? It uses 443 ssl

[3s-gtech]

I think LE needs 80 to be open.

[mavhc]

Using port 443 with LE is being worked on, the protocol now exists, tls-alpn-01, however certbot and apache don't support it yet.

 

https://github.com/certbot/certbot/issues/6724

 

https://icing.github.io/mod_md/acmev2.html

[timbo343]

I think LE needs 80 to be open.

This very reason however I'm presuming it can be closed on the firewall once the certificate has been installed / re-newed