How to set password policies

System-wide password policies are accessible from the Password policies link in the General User Settings dialog box, that can be opened from the Users panel. The Password Policies dialog is shown below. For security reasons, it is recommended that must have at least 8 characters, must be mixed-case and must contain a digit are enabled.

Password Changes and Expiry

Permit password changes is enabled by default in new trial installations, but are disabled by default otherwise. When enabled, non-Windows users are able to change their password, but none of the other inbuilt authentication methods (i.e. Windows, AD, gateway, external and SAML) allow password changes. Custom authenticators may define a way to change password.

There are multiple ways that a user can change their password:

HTTP/HTTPS: users who have logged in can change their password by clicking the change password link on the account management page; users who are not logged in can use the forgot/reset password feature (see below).
FTP/FTPS: once logged in users can change their password using the SITE CPWD command.
SSH (SFTP/SCP): once logged in users can change their password using the cpwd command. Some SFTP and SCP clients permit opening an SSH terminal/shell.

CompleteFTP supports forced expiry of the passwords of non-Windows users. This functionality is controlled by two settings: Require change after N days and Expire after N days. Both of these are not set by default, meaning that passwords never expired.

When the Require change after N days setting is set, a non-Windows user will be forced to change their password if it's been more than N days since the last time they changed their password, but only if they're not logging in via FTP. FTP has no mechanism for forcing users to change their password, so they're simply shown a warning. In SFTP, SSH, HTTP and HTTPS, the user won't be given access to any files until they've changed their password.

When the Expire after N days is set, a non-Windows user will be blocked from accessing the server if it's been more than N days since they changed their password. This happens for all protocols.

The password expiry settings have no effect on Windows users or users who authenticate via other means, such as SAML, databases and gateways. The reason for this is that CompleteFTP doesn't control these passwords.

Forgot/Reset Password

Users who have forgotten their passwords can use the forgot/reset password feature to set a new password. To do this they must:

Click the 'Forgot password?' link on the login web-page.
Enter their user-name or email address to have an email message containing a password reset link sent to them.
Look in the email inbox for the message; open it and click the link to open a password reset page.
Enter their new password twice.

The 'Forgot password?' link will be visible only if:

permit password changes is enabled in CompleteFTP's password policy (see top of this page)
AND a file named customizations.jss is present in the directory, C:\ProgramData\Enterprise Distributed Technologies\Complete FTP\Include\Custom. If the file isn't already there then it must be created.
AND the following line is in the customizations.jss file.
```
passwordResetEnabled = true;
```

The password reset message will only be sent to the user if:

CompleteFTP's SMTP configuration has been set (Email Settings category in the site/settings panel)
their email address has been set
the user is actually able to change their password via CompleteFTP (see above)

Users won't be informed if the password reset message could not be sent as this would allow attackers to discover valid user-names. The reason for the failure will be written to CompleteFTP's log file, though.

Password Storage

Store encrypted passwords is not enabled by default. Usually, passwords for non-Windows users are not stored for security reasons. Instead, a hash of the password is stored, and when users log in, the hash of the password they supply is compared with the stored hash.

If Store encrypted passwords is enabled, passwords for non-Windows users will be stored in encrypted form. This is less secure than using a hash, but does mean that the adminstrator is able to retrieve passwords.

Note that Windows users do not have passwords stored by CompleteFTP in any way. Instead, standard Windows authentication is used.

Password Requirements

Must be mixed-case, must contain a digit, and must contain a special character are not enabled by default.

Any passwords that are less than the Minimum password length will be rejected.