EFT Server provides the option to force administrators to change their password on log in. On HS-enabled Sites, users are forced to change their passwords on first use.
You can enable the password reset page while disallowing general access to HTTP or HTTPS. When a new user logs in to EFT Server via the HTTP or HTTPS index page, EFT Server redirects the user to the reset page. After the user creates a new password, they are returned to the index page.
|
|
Password initial reset, expiration,
and account management features only apply to Sites using GlobalSCAPE
EFT Server Authentication and ODBC Authentication. These options
are not available if other authentication types (AD, LDAP) are used. Password
security features all apply at EFT Server level, not to individual accounts. |
To configure administrator accounts to enforce password reset
In the Administrator, connect to EFT Server and click the Server tab.
In the left pane, click the Server node you want to configure.
In the right pane, click the Administration tab.
Click Password Policy. The Password Security Settings dialog box appears.
Select the Admin must reset their password after first login check box. Administrators are prompted to change their password when they log in to the Site.
Click OK to close the dialog box.
Click Apply to save the changes on EFT Server.
When a password is reset, EFT Server verifies the new password against complexity criteria and password history, if those features are enabled. The administrator is not allowed to proceed with the session until a password is created and accepted by the system. If the password is not accepted by the system:
In HTTPS and SFTP, the authentication request will be denied.
In FTP, no further FTP commands will be accepted until the new password is provided and meets complexity and password history requirements, if those features are enabled.
For PCI DSS- (Multifaceted security standard that includes requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures.)enabled Sites:
PCI DSS requirement 8.5.3 states that you should set first-time passwords to a unique value for each user and force users to change their password immediately after the first use.
A warning appears if you clear the Admin must reset their password after first login check box. If an administrator logs in using a temporary password, a warning appears to prompt the administrator to supply a new password.
