Implementing Password Security Rules
This functionality portrays the configuration of system usage passwords, providing a higher level of security with the usage of different characters.
⚠️ Attention!
This security policy is not available for LDAP users.
- From version Helium 2.1.0, when updating the application, the system will automatically configure the following parameters of the privacy policy screen:
- The "Enable Password Policy" field will be configured as enabled;
- The "Minimum Size" field will be set to 8;
- The "Require" field will come with Lowercase, Uppercase, Numbers, and Symbols options configured as enabled;
- The "New password" field cannot be equal to the previous ones, it will be set in 2;
- The "Require password" change on the first login field will be configured as enabled;
- The "Password duration" field will be set as 2 months.
- The system will require changing the password at the first login, after an update or installation;
- For updates, if the password policy is already enabled, the system will respect the client's settings;
- If the application has its version changed again in less than 2 months, set in the initial configuration, the system will not request a password change for local users who have already made the change;
- These settings will only be valid for local users;
- By enabling the "User Blocking Policy", the administrator authorizes the blocking of external or internal users;
- The use of captcha changes the way of logging in, having an extra method of authentication;
- The administrator, if enabling user blocking, can send e-mail to those responsible for system security.
Procedure
- Access the main menu System > Settings > Policy Settings;
- Enable the "Enable password security policy" key;
- In the "Password force" field, the manager must define the minimum number of password characters (minimum value of 8) and it will contain requirements of: uppercase letter, lower case, numbers, and symbols;
- Define the number of previous passwords in which the new one cannot be equal, in the limiter "The new password cannot be the same as the previous ones";
- For new users, the password change can be defined by clicking on the "Require password change on the first login" key ;
- In the "Password expiration" field, define the time to expire the password;
- For users who are already in operation, it's possible to force the password change of the new configuration, from the next login, click on the key "Force password change at next login for all users";
From version 9.1.2.23 or 9.2.1.0, new parameters were added:
8. Enable the "Enable user blocking policy" key:
- A symbol with an "i" stating that: Will be considered for both internal and external logins;
9. Enable the "Enable Captcha at Login" key: This functionality enables a mandatory check for connections of all users in the system; during the login;
10. In the User blocking field, the administrator must define the minimum number of successive errors of credentials for user blocking, this blocking occurs for both internal and external users and the unlocking is performed inside the product;
11. Define the time of successive credential errors from the last minutes to block the user: This field is linked to the "Block user after successive credential errors" field since the system needs a time parameter to compare the amount of error in a certain period of time and do not consider the user to be blocked if they are not within the defined time limit for reaching the number of attempts to block;
12. In the "Notifications" field, the following must be defined:
- Send security alert to the group: Inform the group to whom the alert email will be sent in case of the blocked user for exceeding the configured attempts;
- Send security alerts to e-mails: Inform the e-mail of possible employees who should be alerted in case of user blocking. E-mails must be separated by a comma and with no space between them and no space at the end;
⚠️ Attention!
If the system identifies the e-mail of the user to whom the access was blocked, this user will also receive a blocking e-mail. The blocking e-mail template is not available for change in this version.
13. Click on "Save".