Enforcing Strong (Complex) Passwords

The HSM allows you to enforce the use of complex passwords. If you do not activate the HSM, this feature is disabled after the 30-day trial expires.

When you create or update a user account, you can require the user to create strong (complex) passwords. Complex passwords are enabled by default when you create a Site using the "strict security settings" option. A complex password must meet the following criteria:

• Minimum length (from 6 to 99 characters).

• Contain N or more characters from the user's account name

• Not contain N or more repeating characters.

• Not be comprised solely of a word in a dictionary file (forward or backwards)

• Contain at least one character from each of the following categories. The number of characters can never be fewer than the number of chosen categories, but can be greater.

• • English uppercase characters (A - Z)

  • English lowercase characters (a - z)

  • Base 10 digits (0 - 9)

  • Non-alphanumeric (for example: !, $, #, or %) or Unicode characters

  • Non-alphanumeric characters are not required by default; you must explicitly specify this option if you want to require it. For those who might be using a non-English language operating system, it is best to leave the Non alpha-numeric check box cleared because of characters that are not normally found on a standard keyboard. In this case, your users are free to use non-alphanumeric characters when they create their own password, you just would not require that they do, and the system will not include them when you automatically generate a complex password.

For example, suppose you specified that the password must:

• contain at least 6 characters

• contain uppercase letters

• contain lowercase letters

• contain numbers

That means that the password must contain at least one uppercase character, at least one lowercase character, and at least one digit. So in this case, a password could be A5s3*v35, but not a5s3*v35, because you specified that a password should have at least one uppercase letter.

To enforce complex passwords on user accounts

1. In the administration interface, connect to EFT Server and click the Server tab.

2. In the left pane, click the user or Settings Template you want to configure, then click the Security tab.

3. Select the Enforce strong (complex) passwords check box, then click Configure. The Password complexity settings dialog box appears.

   If the check box and Configure button are grayed out, they are inheriting the setting from the Site or, for a user, the Settings Template.

4. Specify the password complexity per the guidelines in the table below:

   Field	Default	Min/Max Values
   Minimum password length	8	6 - 99
   The password must contain characters from at least N of the following categories: Uppercase Lowercase Numeric (0-9) Non alpha-numeric (e.g., !, #, $, %)	3 categories	2 categories, up to the maximum password length
   Must not contain N or more characters from the user name	>3	2 characters, up to maximum password length
   Must not contain N or more repeating characters.	3	2 characters, up to maximum password length
   Must not consist solely of a word in the following Dictionary file. (Click the ellipse icon  to select a file.)	on	n/a
   Must not be a dictionary word backwards	off	n/a

    

   The dictionary file cannot exceed 10 MB. If you exceed the file size, the Event log will indicate that not all of the file could be loaded. If the dictionary file is not available, EFT Server operations will continue and a log error is written to the Event log.

5. Click OK to save the settings or Cancel to keep existing settings.

6. Click Apply to save the changes to EFT Server.

   COM-created accounts are not subject to complexity requirements unless the CreateComplexPassword method is used. Refer to the GlobalSCAPE Server COM API user guide for details.

Related Topics

Enforcing Password Reset for Administrator Accounts

Enforcing Password Reset on the Site