docs/designs/expired-password.md

1 # Initial expired passwords
30    password) may be expired.
32    account is valid except the account's password is expired (such as indicated
47 Note the terminology: An "expired password" is a special case of "password
54     credentials, whether or not those credentials have expired and must be
67 - The BMC's initial password must be expired when the new EXPIRED_PASSWORD image
69 - An account with an expired password must not be allowed to use the BMC (except
71 - There must be a way to change the expired password using a supported
92    enabled, the BMC's default password will initially be expired as if via the
94    and is not based on time. An account with an expired password is neither
102    access via an account which has an expired password. If the access
104    failure is an expired password (determined by the usual Linux practices),
105    where possible, the interface should indicate the password is expired and how
119    The `ipmitool` command treats an expired password the same as an invalid
125    when the password is expired. No change is needed. But see the next bullet
126    for the expired password dialog.
128 3. There is a way for an account owner to change their own expired password.
133    - SSH server: The SSH servers may have an expired password change dialog. For
135      announces the password is expired, but does not implement the dialog to
152 This design is intended to cover any cause of expired password, including both
153 the BMC's initial expired password and password expired for another cause such
161 expired password:
168 - At this point the web app can display a message that the password is expired
224 Having to change an expired password is annoying and breaks operational
229 needed to detect and change an expired password.
243 2. Ensure factory reset resets the password to its initial expired state (repeat
252    update to a release which has the default expired password design (this
256    to power off the host while the BMC's password is expired.
259 7. Validate you can to change an IPMI user's expired password, such as with: