EFT Server provides the option to force administrators to change their password on log in. On Sites defined using the "strict security settings," users are forced to change their passwords on first use.
You can enable the password reset page while disallowing general access to HTTP or HTTPS. When a new user logs in to EFT Server via the HTTP or HTTPS index page, EFT Server redirects the user to the reset page. After the user creates a new password, they are returned to the index page.
|
EFT Server cannot ask FTP users to change
their password prior to logging in and identifying themselves.
EFT Server allows them to login (authenticate), but then prevents
any further interaction until they change their password. |
To configure administrator accounts to enforce password reset
In the administration interface, connect to EFT Server and click the Server tab.
In the left pane, click the Server node you want to configure.
In the right pane, click the Administration tab.
Click an EFT Server-managed administrator account, then click Password Policy. The Password Security Settings dialog box appears.
Select the Admin must reset their password after first login check box. Administrators are prompted to change their password when they log in to the Site.
Click OK to close the dialog box.
Click Apply to save the changes on EFT Server.
When a password is reset, EFT Server verifies the new password against complexity criteria and password history, if those features are enabled. The administrator is not allowed to proceed with the session until a password is created and accepted by the system. If the password is not accepted by the system:
In HTTPS and SFTP, the authentication request will be denied.
In FTP, no further FTP commands will be accepted until the new password is provided and meets complexity and password history requirements, if those features are enabled.
For PCI DSS-enabled (strict security) Sites:
PCI DSS requirement 8.5.3 states that you should set first-time passwords to a unique value for each user and force users to change their password immediately after the first use.
A warning appears if you clear the Admin must reset their password after first login check box. If an administrator logs in using a temporary password, a warning appears to prompt the administrator to supply a new password.
