topic Re: Changing the password - the old and the new one work in General Topics

Changing the password - the old and the new one work

MiniNinja — Wed, 24 Jul 2024 05:09:45 GMT

Hello Team,

R81.20 take 65 SMS (I've tried take 41 before) and gateway 5400 with R81.20 take 41.

Mobile access is enabled, integration with AD via SSL (LDAPS) is configured, the ability to change the password is configured according to https://support.checkpoint.com/results/sk/sk89841

If the password has expired or you need to change it at the first login, that through the portal that the client (tried 87.50 and 88.40) the change is successful. But the old password is still accepted for about 5 minutes. The new password also works at the same time.

How can I fix it?

Re: Changing the password - the old and the new one work

PhoneBoy — Wed, 24 Jul 2024 14:46:23 GMT

Sounds like we're caching the password, which I believe is expected behavior.
I would consult with TAC to confirm: https://help.checkpoint.com

Re: Changing the password - the old and the new one work

MiniNinja — Wed, 24 Jul 2024 17:05:54 GMT

Thanks for your reply, but at least in the Global Settings, password caching options are disabled. Where and how can I change the caching time? I suspect that this is done through the database.

Re: Changing the password - the old and the new one work

Lesley — Wed, 24 Jul 2024 17:33:22 GMT

I suspect this is AD related and not Check Point. Also due the fact the AD is handeling the password / authentication part.

Here they explain it for example for NTLM auth:

https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/new-setting-modifies-ntlm-network-authentication

On Windows the default value is 5 minutes that is changed in register.

Best effor you could try this (I work with CP and Microsoft)

1) Start registry editor 'regedit.msc'.

2) Follow the registry subkey 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa'.

3) 'Right-click' 'Lsa', select 'New' and select 'DWORD Value'.

4) Enter OldPasswordAllowedPeriod as the name of the 'DWORD'.

5) 'Right-click' OldPasswordAllowedPeriod, then select 'Modify'.

6) Enter a value for the Value data box. This value is a life time for the old password in minutes.

For example, the old password can be used for 5 mins after the password change if the value is set to 5. To disable, enter 0.

Rebooting the server is not needed.

Re: Changing the password - the old and the new one work

MiniNinja — Wed, 24 Jul 2024 17:54:26 GMT

An interesting idea, I'll try to test it, but it's strange that OWA only accepts a new password, even Outlook asks for a new one after a short period of time (I didn't check exactly how long).

Re: Changing the password - the old and the new one work

the_rock — Wed, 24 Jul 2024 19:38:10 GMT

I assume below is set to no?

Andy

Re: Changing the password - the old and the new one work

MiniNinja — Thu, 25 Jul 2024 10:36:06 GMT

Yep

Re: Changing the password - the old and the new one work

MiniNinja — Thu, 25 Jul 2024 10:44:16 GMT

Alas, what you suggested did not help, I even rebooted the test VM and the result is the same, the system accepts both the old and the new password.

Re: Changing the password - the old and the new one work

Lesley — Thu, 25 Jul 2024 10:56:21 GMT

I think this is related to the AD servers itself not for test servers.

Re: Changing the password - the old and the new one work

the_rock — Thu, 25 Jul 2024 11:39:01 GMT

I will check guidbedit later to see if there is something there related to this.

Andy

Re: Changing the password - the old and the new one work

the_rock — Thu, 25 Jul 2024 12:25:25 GMT

So if you log into guidbedit, kjust click on global properties, ctrl+f, search for password, see values you get. I verified in mine and all seem by default.

Andy

Re: Changing the password - the old and the new one work

MiniNinja — Thu, 25 Jul 2024 16:57:05 GMT

Yes, I also have

Re: Changing the password - the old and the new one work

the_rock — Thu, 25 Jul 2024 17:00:18 GMT

Then I got nothing else, sorry mate : - (

Lets us know what TAC says and how it gets solved.

Andy