We have an IBM z/OS system that I am part of the administration team on which we often have to reset users' passwords. (forgotten, too many violations etc).
We do this my choosing a new password and assigning it to their id. We then email the user with their new password.
I know this is bad but am uncertain how we can improve the process?
My current idea is to provide a website which can produce a public and private RSA key pair, have them send us the public key which we then use to encrypt their new id and which they can then decrypt with the relevant private key.
What is the recommended process for systems whereby passwords resets are a manual process and the new password must be given back to the user?
The OS is z/OS, the security system is ACF2 and changing a password is done via a CLI-type interface, where an authorised user simply issues a 'change' command with the userid and the new password in cleartext.
the email informing the user of their new password is done via internal mail, but will often be sent internationally. The user will have to change their password upon first use.