Enforcing Password Reset for Administrator Accounts
EFT Server provides the option to force password reset on log in. On
HS-PCI-enabled Sites, users are forced to change their passwords on first
use.
You can enable the password reset page while disallowing general access
to HTTP or HTTPS. When a new user logs in to EFT Server via the HTTP or
HTTPS index page, EFT Server redirects the user to the reset page. After
the user creates a new password, they are returned to the index page.
|
|
Password initial reset, expiration,
and account management features only apply to Sites using GlobalSCAPE
EFT Server Authentication and ODBC
Authentication. These options are not available if other authentication
types (AD,
LDAP) are used. Password security
features all apply at the Server level, not to individual accounts.
EFT Server cannot ask FTP users to change their password prior to logging
in and identifying themselves. EFT Server allows them to login (authenticate),
but then prevents any further interaction until they change their password.
|
To configure user accounts to enforce password reset
In EFT Administrator, connect
to EFT Server and click the Server
tab.
In the left pane, click the Server you want to configure.
In
the right pane, click the Administration
tab. The Password Security settings
appear in the bottom half of the tab.
Select
the Admin must reset their password after
first login check box. Administrators are prompted to change their
password when they log in to the Site.
Click Apply to
save the changes on EFT Server.
When a password is reset,
EFT Server verifies the new password against complexity criteria and password history, if those features are
enabled. The administrator is not allowed to proceed with the session
until a password is created and accepted by the system. If the password
is not accepted by the system:
In HTTPS and SFTP, the authentication request will be
denied.
In FTP, no further FTP commands will be accepted until
the new password is provided and meets complexity and
password history requirements,
if those features are enabled.
For PCI DSS-enabled
Sites:
PCI DSS requirement 8.5.3 states
that you should set first-time passwords to a unique value for each user
and force users to change their password immediately after the first use.
A warning appears if you clear the Admin
must reset their password after first login check box. If an administrator
logs in using a temporary password, a warning appears to prompt the administrator
to supply a new password.