CLASSE Password Requirements

CLASSE has the same password requirements as does Cornell's central IT organization. See http://www.it.cornell.edu/security/identity/passwords/strong.cfm for a description of Cornell's requirements and suggestions for generating a password.

Briefly, CLASSE passwords have requirements enforced by builtin Kerberos policies. The default policy requires a minimum of 8 characters from at least 3 classes. The five possible classes are lowercase, uppercase, numbers, punctuation, and all other characters.

Also, a password may not be

• a previously used password
• a single word or proper name found in any dictionary
• a single word or proper name found in any dictionary spelled backward
• a word found in a dictionary but with its letters replaced by visually similar numbers or symbols (aka leet speak -- see http://en.wikipedia.org/wiki/Leet )
• some common two-word combinations

CLASSE User Accounts and Passwords

When you first set up a CLASSE account, you must also link it to CLASSE Duo.

For a detailed description of computer accounts at CLASSE, please see DetailedUserAccountsAndPasswords

When you change your passwords, you must include characters from at least 3 of the 4 character classes: upper case, lower case, numbers and special characters. See CLASSE Password Requirements below.

1. CLASSE authentication (Microsoft kerberos)

CLASSE authentication is used for

• Windows
• SAMBA file servers
• CLASSE VPN
• Protected CLASSE web services. For example, https://wiki.classe.cornell.edu, https://svn01.classe.cornell.edu, etc.
• CLASSE Linux computers.

Your CLASSE account must be renewed periodically, usually every two (2) years. You will get an e-mail notice to renew.

To change your CLASSE password, you can use any of these following alternatives:

• From any Mac
  • Click/tap HERE for directions
    (Note:this also changes the password in the Secure Enclave if FileVault is enabled - see Volume Encryption with FileVault)
• CLASSE-managed Macs
  • Click/tap HERE for more information password management on Macs bound to the CLASSE Active directory
  • The password change will synchronize with the CLASSE Active Directory within a short time the next time the Mac is on a CLASSE network (or within a short time if it is already on a CLASSE network)
• From any Mac without FileVault enabled, use your Web browser to go to
  • https://www.classe.cornell.edu/pwm/ -or-
  • on a CLASSE network (e.g. "LNS Protected") or on a CLASSE VPN
    1. open a terminal window
    2. type the command kpasswd yourclasseuserid@CLASSE.CORNELL.EDU
       (this command is case sensitive. You must type @CLASSE.CORNELL.EDU in capital letters.)
• WARNING: do NOT expect password changes made on one computer to propagate to the local caches on a separate Mac computer!

• From any Linux or Windows computer, use your Web browser to go to
  • https://www.classe.cornell.edu/pwm/

• From a CLASSE Windows computer:
  1. login using your CLASSE userid and current password
  2. press CTRL-ALT-DEL
  3. click on the line Change a password...

• from a CLASSE Linux computer (e.g. LNX201.CLASSE.CORNELL.EDU )
  1. open a terminal window
  2. type the command kpasswd

• from outside the Lab
  • use the Web page at https://www.classe.cornell.edu/pwm/
  • use ssh or PuTTY to login to a CLASSE Linux computer, then follow the instructions above
  • remotely access a CLASSE virtual Windows computer. See Windows remote access instructions.

CLASSEPasswordLandingPage