NERSC Password Policy and Procedures

A user is given a username (also known as a login name) and associated password that permits her/him to access a given NERSC machine or machines. This username/password pair may be used by a single individual only: passwords must not be shared with any other person.

Passwords must be changed as soon as possible after exposure or suspected compromise. Exposure of passwords and suspected compromises must immediately be reported to NERSC at security@nersc.gov or the Account Support Group, support@nersc.gov.

• Password and Account Protection
• New Users
• Login Failures
• Obtaining a New Password
• Changing Your Password
• Department of Energy Password Requirements
• HPSS/DCE Passwords

Password and Account Protection

NOTE: Each user is responsible for all activities originating from any of his or her username(s).

Passwords and usernames must NOT be shared under any circumstances. Users who share their passwords or usernames will have their access to NERSC disabled. Users should not leave clear-text passwords in a location accessible to others or secured in a location for which protection is less than that required for protecting the information that can be accessed using the password.

See Account Ownership Policy.

New Users

NERSC must have a signed user policy form on file before assigning a user a password on a NERSC system. Once this form has been signed, the Account Support group will contact you by phone to assign a temporary password and to activate your username(s) on the appropriate systems. You will have to change this password the first time you login.

Login Failures

NOTE: Your password will be disabled if you have three login failures while entering your password on a NERSC machine. Call the Account Support group at 800-666-3772, menu option 2, or 510-486-8612 to have your password failures cleared.

Obtaining a New Password from NERSC Account Support

If you have forgotten your password, call the Account Support group at 800-666-3772, menu option 2, or 510-486-8612 to reset your password. You will have to change this password the next time you login.

Changing Your Password

Passwords must be changed under any one of the following circumstances:

• At least every six months.
• Immediately after giving your password to someone else.
• As soon as possible, but at least within one business day after a password has been compromised or after you suspect that a password has been compromised.
• On direction from NERSC staff.

Your new password must adhere to the Department of Energy requirements below.

All of NERSC's computational systems are manged by the LDAP protocol and use the NIM password. Passwords cannot be changed directly on the computational machines, but rather the NIM password itself must be changed:

1. Point your browser to nim.nersc.gov and login to NIM.
2. Select Change NIM Password from the Actions pull-down list in the NIM main menu.

See HPSS Passwords and Authentication for instructions on how to change HPSS passwords.

Department of Energy Password Requirements

As a Department of Energy facility, NERSC is required to adhere to Department of Energy guidelines regarding passwords. The following requirements conform to the Department of Energy guidelines regarding passwords, namely DOE Order 205.3 and to Lawrence Berkeley National Laboratory's RPM  §9.02 Operational Procedures for Computing and Communications.

Different NERSC systems have different software environments with minor variations in software constraints on passwords. When users are selecting their own passwords for use at NERSC, the following requirements must be used. It is the responsibility of the user to select a password that adheres to the following requirements, regardless of whether or not the system is capable of enforcing them.

• Passwords must contain at least eight nonblank characters.
• Passwords must contain a combination of upper and lowercase letters, numbers, and at least one special character within the first seven positions.
  
• Passwords must contain a nonnumeric letter or symbol in the first and last positions.
• Passwords must not contain the user login name.
• Passwords must not include the user's own or (to the best of his or her knowledge) a close friend's or relative's name, employee number, Social Security number, birthdate, telephone number, or any information about him or her that the user believes could be readily learned or guessed.
• Passwords must not (to the best of the user's knowledge) include common words from an English dictionary or a dictionary of another language with which the user has familiarity.
• Passwords must not (to the best of the user's knowledge) contain commonly used proper names, including the name of any fictional character or place.
• Passwords must not contain any simple pattern of letters or numbers such as "qwertyxx".