Stolen Passwords

Suppose someone steals Lee's password. Blocking the address they used will stop connections from that address, but they could try the same password from somewhere else.

You need to replace the stolen password. This is called a password reset. At Lumen, a reset also signs out anyone who is currently using the account:

seclab reset lee

You should see:

Password reset for lee. Every session they had is signed out.

An account can stay signed in after the user enters their password. This is called a session. To check whether Lee is still signed in anywhere, run:

seclab sessions lee

You should see:

lee is not signed in anywhere.

The result shows that no sessions remain. Lee can sign in again with the new password, but the attacker can no longer use the stolen one.