Specifications

CHAPTER 13: ADVANCED ADMINISTRATION 189
Strong Password Settings
Strong password rules require users to observe strict guidelines when creating passwords, which
makes the passwords more difficult to guess and, in theory, more secure. Strong passwords are
not enabled in CC-SG by default. In order to use strong passwords, administrators must first
check Strong Passwords Required For All Users.
Note: A strong password that includes all strong password requirements is always required for
the CC Super-User.
Once enabled, administrators can edit the fields in the Strong Password Settings area to customize
their password rules. At minimum, all strong passwords must be configured with the following
criteria:
• Minimum Password Length – All passwords must contain a minimum number of characters.
Click the drop down menu and select the minimum length of passwords.
• Password History Depth – Click the drop down menu and select how many previous
passwords are kept in the history. While in the history, users will not be able to reuse a
password when asked to choose a new one. For example, if Password History is set to 5,
users cannot reuse any of their last 5 passwords.
• Password Expiration Frequency – All passwords must expire after a set number of days.
Click the drop down menu and select the number of days passwords remain valid. After a
password expires, users will be asked to choose a new password the next time they log in.
In addition, any four contiguous characters in the user name and the password cannot match.
Under Strong Password Requirements, the administrator can configure password rules to
require a number of extra items:
• Passwords must contain at least one lower case letter.
• Passwords must contain at least one upper case letter.
• Passwords must contain at least one number.
• Passwords must contain at least one special character (for example, an exclamation point or
ampersand).
When you are done configuring strong password rules, click Update to save the settings. All
selected rules are cumulative, that is all passwords must meet every criteria that the administrator
configures. After configuring strong password rules, all future passwords must meet these criteria
and all existing users will need to change their passwords at their next logins if the new criteria
are stronger than the previous criteria.. Strong password rules apply only to user profiles stored
locally. Password rules on an authentication server must be managed by the authentication server
itself.
Raritan suggests using the Message of the Day feature to provide advanced notice to users when
the strong password rules will be changing and what the new criteria are.