You are here: Home > Server Configuration > Configuring Server Administrators > Enforcing Password Reset for Administrator Accounts
For more information, scroll through the topics in the Index or review the topics in the table of contents to the left. If the Index and Contents are hidden, click <--Show Table of Contents.
Enforcing Password Reset for Administrator Accounts
EFT Server provides the option to force administrators to change their password on log in. On HS-enabled Sites, users are forced to change their passwords on first use.
You can enable the password reset page while disallowing general access to HTTP or HTTPS. When a new user logs in to EFT Server via the HTTP or HTTPS index page, EFT Server redirects the user to the reset page. After the user creates a new password, they are returned to the index page.
|
|
Password initial reset, expiration, and account management features only apply to Sites using GlobalSCAPE EFT Server Authentication and ODBC Authentication. These options are not available if other authentication types (AD, LDAP) are used. Password security features all apply at EFT Server level, not to individual accounts.
EFT Server cannot ask FTP users to change their password prior to logging in and identifying themselves. EFT Server allows them to login (authenticate), but then prevents any further interaction until they change their password.
Refer to Using the High Security Module with the Secure Ad Hoc Transfer Module if you are using a High Security Site.
|
To configure administrator accounts to enforce password reset
-
In the EFT Server administration interface, connect to EFT Server and click the Server tab.
-
In the left pane, click the Server node you want to configure.
-
In the right pane, click the Administration tab.
-
Click an EFT Server-managed administrator account, then click Password Policy. The Password Security Settings dialog box appears.
-
Select the Admin must reset their password after first login check box. Administrators are prompted to change their password when they log in to the Site.
-
Click OK to close the dialog box.
-
Click Apply to save the changes on EFT Server.
When a password is reset, EFT Server verifies the new password against complexity criteria and password history, if those features are enabled. The administrator is not allowed to proceed with the session until a password is created and accepted by the system. If the password is not accepted by the system:
-
In HTTPS and SFTP, the authentication request will be denied.
-
In FTP, no further FTP commands will be accepted until the new password is provided and meets complexity and password history requirements, if those features are enabled.
For PCI DSS- enabled Sites:
-
PCI DSS requirement 8.5.3 states that you should set first-time passwords to a unique value for each user and force users to change their password immediately after the first use.
-
A warning appears if you clear the Admin must reset their password after first login check box. If an administrator logs in using a temporary password, a warning appears to prompt the administrator to supply a new password.