Kerberos - Lantronix SCS Reference Manual

Security
11.4.1.5 Forcing Selection of a New Password
Users may be forced to select a new password during their next login. This is useful when the user has
forgotten his or her password, or to ensure that passwords are changed on a regular basis.
Local>> DEFINE AUTHENTICATION USER "elmo" EXPIRED
11.4.1.6 Displaying the Local Database
Local database entries can be checked with the Show/Monitor/List Authentication User command. All
users, their passwords, and other parameters are listed.
See Show/Monitor/List Authentication on page 12-177.
Note:
11.4.1.7 Purging the Local Database
To remove a particular user from the database, use the Clear/Purge Authentication User command. See
Clear/Purge Authentication on page 12-151 for a complete description of this command.

11.4.2 Kerberos

The Kerberos Authentication Service is a network-based authentication service. Passwords are always
transmitted in encrypted form. The SCS supports Kerberos version 4.
Kerberos is available as public-domain software and from commercial vendors. Please refer to your
Kerberos server documentation for detailed information about setting up a Kerberos server, registering
Kerberos clients, and administering a Kerberos network.
Kerberos advantages include the following:
Passwords are always encrypted; it is not possible to obtain a user's password by eavesdropping on
a connection attempt.
Kerberos is a widely-accepted standard, and is proven to be secure.
The SCS may easily be added to an existing Kerberos network.
A large number of users may be supported.
Disadvantages include:
Configuring the Kerberos database can be complicated.
Kerberos does not guard against guessing a user's password.
If the caller attempts to use CHAP for authentication, Kerberos cannot be used.
Kerberos authentication is case-sensitive.
Note:
Figure 11-23: Forcing a User's Password to Expire
11-11
Database Configuration