Two-factor authentication and password policy

Where

Administration, Security, Sign-in holds four panels: Two-factor authentication, Sign-in protection, Password policy and Session length.

Two-factor authentication

There is no personal opt-in: a second factor is set up only when the system asks for one. With Require it of everybody switched on, everybody whose account has a password of its own in GoProject sets up an authenticator app (TOTP, six-digit codes): on the screen that follows the sign-in or, while the grace period runs, under Profile, Security. Accounts without such a password, directory accounts among them, are not asked. Beside the switch:

• Give people time to set it up: a grace period in hours; without one, a person without an authenticator gets no further than the setup screen
• Group that is never asked: for accounts that are not people
• Switching the requirement on signs everybody out, you included

If the phone is out of reach, a person can ask for a code by e-mail from the sign-in screen. It is the fallback: it expires in 10 minutes and accepts at most five wrong guesses. It needs working outgoing mail.

An administrator can take an authenticator off a person with Reset two-factor authentication on the user; they set up a new one at their next sign-in and are told by mail.

Sign-in protection

On by default. After 3 misses the sign-in waits, and each further miss makes the wait longer: 1, 3, 6, 10, then 30 minutes, the last step repeating. A wrong password and a wrong code both count. Optionally, Lock the account instead of waiting after a number of misses (default 10); only a system administrator unlocks it, with Unlock sign-in on the user.

Password policy

Following NIST SP 800-63B:

• Shortest password: 12 characters by default
• Kinds of character: nothing required by default
• Refuse the passwords everybody knows: on
• Refuse the person's own name and address: on
• No repeating recent passwords: off by default (0)

There is no password expiry, on purpose. The policy applies the next time somebody chooses a password.

Resets and forced changes

• Forgot password? on the sign-in screen sends a link for active, internal, local accounts only. It is valid for 24 hours and once, at most three letters an hour per account, and no letter goes out while no site address is set. The answer is the same for any address, and a locked account stays locked
• Reset password on a user (Administration, Users and groups) generates a new password shown once to the administrator, ends the person's sessions and makes them choose their own password at the next sign-in
• Directory accounts change their password in the directory

Session length

Idle: 8 hours by default, counted from the last request. Maximum: 24 hours from sign-in by default; 0 turns it off.