Getting User passwords

[zag]

To be able to setup new cloud email accounts for our staff I need their usernames and passwords in a CSV.

 

Is there any way as an administrator I can do that easily? I can get the usernames from Active directory but the passwords don't seem to show.

 

I could request them all to send their passwords over email but that seems a little insecure to me

Edited January 20, 2011 by zag

[Hightower]

Why can't you just set them up with a random password? Trying to hack their passwords doesn't sound too clever in my opinion, and could land you in a whole heap of trouble.

 

I wouldn't even ask a member of staff for their passwords - a password is a personal thing. I'd be pretty miffed if I found out someone hacked my password out of the system.

[tonyd]

Even on the Windows server, the password itself is not stored, but a hash representing it. These hashes may be copied and then cracking tools run against them, but I think this will only work if they are simple password with no complexity. So, I beleive that what you're asking for cannot be done.

[zag]

Why can't you just set them up with a random password? Trying to hack their passwords doesn't sound too clever in my opinion, and could land you in a whole heap of trouble.

 

I wouldn't even ask a member of staff for their passwords - a password is a personal thing. I'd be pretty miffed if I found out someone hacked my password out of the system.

 

I want them to have single sign on so need their passwords to match their network passwords.

[wesleyw]

Especially if it has none reversible encryption setup up.

[soveryapt]

Easiest way, set it up but warn the staff their passwords will be reset. Give them new passwords so that they can login, then set them to force change once you're sorted and got it syncronised which, I'm guessing, will then update the password for the cloud?

[tonyd]

Single sign on involves having a single place that all the authentication request use. Any other system, as implied above, would require some sort of synchronisation of accounts, allowing for when users change passwords. Also, as the name suggests, single sign on means only having to login once to access multiple services.

[teejay]

Which cloud based email system are you using, stuff like live@edu and google mail have utilities to do the single sign-on.

[Hightower]

I want them to have single sign on so need their passwords to match their network passwords.

 

Yeah, as tonyd has said, that doesn't sound like SSO to me. I've set many systems up for 'proper' SSO and none of them required me to know my staffs passwords.

[jamesbmarshall]

To be able to setup new cloud email accounts for our staff I need their usernames and passwords in a CSV.

 

If you're talking about Live@edu you could set them up with random passwords and inform users that they would need to change them on first login.... however if you're using some ID management like ILM you could set up PCNS and just get the users to change their AD password which will prompt PCNS to sync that change to the cloud...

 

There's no way trying to figure out your own users passwords sounds like a good (or easy, or possible) idea.

[zag]

Yep its for Live@edu, I simply want to setup all of our admin staff (about 15 of them) with accounts as a test.

 

Ideally I could just tell them to log in with their normal [email protected] and passwords

 

I took a look at ILM but gave up on about page 20 of the install instructions

 

I think I will just ask them, its a lot easier.

Edited January 20, 2011 by zag

[jamesbmarshall]

Yep its for Live@edu, I simply want to setup all of our admin staff (about 15 of them) with accounts as a test.

 

If it is for such a small number of test users why not just give them temporary passwords and have them change them? If your admin staff are savvy they won't give up their passwords, and if they do they probably need training about security.

 

ILM is probably overkill for a small test, but once it is up and running it takes the headache away from provisioning / de-provisioning at the start and end of every academic year. Best case scenario is that you have it tied in to your MIS, so that when your admin team do the yearly enrollment your AD users and Live@edu accounts are automatically provisioned through ILM (or FIM...).

 

Outside of Live@du there is a strong case for ID management as more and more systems require some for of ID (MIS, cloud services, databases, VLEs, etc) but have no way to bring it all together.

[zag]

I ended up importing the usernames via ad export >> CSV file and gave them all a password of "password". Users are then asked to change their password on first login.

 

I did find some software that cracked the passwords called L0phtCrack Password Auditor and it worked perfectly on the 10 test accounts I threw at it but a little expensive to buy the full program. Actually pretty scary what it can do!

Edited January 25, 2011 by zag