...
Minimum password length for administrators. The length is enforced when setting a new password or changing the existing one. For security reasons this cannot be set lower than 8 characters.
Password must contain
By checking the required character groups (lowercase and uppercase, digits, symbols) it is possible to increase the complexity of used passwords. The following characters are considered as symbols: ! @ # $ % ^ & *. The character groups are checked when when setting a new password or changing the existing one.
...
When enabled, ensures any new password must not be a part of a known password data breach. The "Have I Been Pwned (HIBP)" service is used to check this. The password is not sent anywhere for this check. Only a 5 character fragment of the SHA1 password hash is sent. For more information see: https://haveibeenpwned.com/API/v3#PwnedPasswords. This is checked when setting a new password or changing the existing one.
Password rules for users
The following rules for user passwords are valid only for local users (created directly in the SOFiE application by an administrator). Remote users (from AD/ADFS) are not affected.
Minimum password length
Minimum password length for users. The length is enforced when setting a new password or changing the existing one. For security reasons this cannot be set lower than 8 characters.
Password must contain
By checking the required character groups (lowercase and uppercase, digits, symbols) it is possible to increase the complexity of used passwords. The following characters are considered as symbols: ! @ # $ % ^ & *. The character groups are checked when when setting a new password or changing the existing one.
Forbid leaked passwords usage
When enabled, ensures any new password must not be a part of a known password data breach. The "Have I Been Pwned (HIBP)" service is used to check this. The password is not sent anywhere for this check. Only a 5 character fragment of the SHA1 password hash is sent. For more information see: https://haveibeenpwned.com/API/v3#PwnedPasswords . This is checked when setting a new password or changing the existing one.
Password rules for packages
Minimum password length
Minimum password length for password protected packages. For security reasons this cannot be set lower than 8 characters.
Password must contain
By checking the required character groups (lowercase and uppercase, digits, symbols) it is possible to increase the complexity of used passwords. The following characters are considered as symbols: ! @ # $ % ^ & *. The character groups are checked when when setting a new password or changing the existing one.
Forbid leaked passwords usage
When enabled, ensures any new password must not be a part of a known password data breach. The "Have I Been Pwned (HIBP)" service is used to check this. The password is not sent anywhere for this check. Only a 5 character fragment of the SHA1 password hash is sent. For more information see: https://haveibeenpwned.com/API/v3#PwnedPasswords . This is checked when setting a new password or changing the existing one.
Mandatory package password - not logged in user
Enforce a password to be set for package access if it is uploaded by a NOT LOGGED IN user (anonym). If enabled, a package without a password (complying with the rules above) cannot be sent.
Mandatory package password - logged in user
Enforce a password to be set for package access if it is uploaded by a LOGGED IN user. If enabled, a package without a password (complying with the rules above) cannot be sent.
Password reset link lifetime
...
Number of seconds for which a password protected package can be accessed without re-entering the password (60 - 1000000).
Validity period of one access to a package with a limited number of accesses
Time in seconds allowed to access a package with a limited number of accesses that will count as one access (60 - 1000000).
reCaptcha
reCAPTCHA secret key
...
Enables or disables the logging of reCAPTCHA test results into the audit log. Should be enabled only temporarily during debugging of problems with sending of packages, because it may create a lot of log entries.
Other settings
Enable repeated password guessing protection
If enabled, then in case of incorrect login attempts it will exponentially increase the time before allowing next login attempt. Up to the maximum time of 10 minutes between attempts.
If disabled, then there is no limit on login attempts. Therefore it should be always enabled for production use, otherwise the accounts are open to rapid automated password guessing and possible account theft.
...
Trusted proxies
The list of IP addresses (comma separated) of trusted proxies.
...