Enhance password security

You can improve account protection in IXM One by applying a few simple security rules.

These settings can significantly strengthen password security and reduce the risk of unauthorized access.

Apply the four-eyes principle

To increase security when creating administrator accounts, the four-eyes principle applies.

This means that creating a new admin account requires confirmation from a second admin user. This ensures that no single user can create or assign administrative privileges alone.

The respective setting in the master.config file is enabled by default.

<add key="FourEyesPrincipleEnabled" value="true"/>

Note

We recommend leaving the four-eyes principle enabled. Disabling it would compromise security.

Ensure brute force protection

Brute force protection helps prevent automated or dictionary-based login attacks.

When users repeatedly enter incorrect passwords, their account is temporarily blocked by default before they can try again:

• 3 failed attempts: Blocked for 30 seconds

• 4 failed attempts: Blocked for 60 seconds

• Further failed attempts: Blocked for 120 seconds

You can adjust these settings if needed. To do so, perform the following steps:

1. Open the master.config file.

2. Go to the Main section.

3. Edit the following settings:

   • LoginBanAutoResetDurationMinutes: Specify how long a user remains blocked after multiple failed login attempts (default: 5 minutes).

   • LogSuccessfulLogins: To record successful logins set this setting to true.

4. Save your changes and close the file.

Example

The entries including default settings look like this:

<add key="LoginBanPeriodsSeconds" value="0, 0, 0, 30, 60, 120"/>
<add key="LoginBanAutoResetDurationMinutes" value="5"/>
<add key="LogSuccessfulLogins" value="false"/>

Set password expiry

To ensure users update their password regularly, you can enforce password expiration. This forces users to change their password after a specified time period.

You can adjust this settings if needed. To do so, perform the following steps:

1. Open the master.config file.

2. Go to the Main section.

3. Set the value of PasswordExpirationDays to the number of days after which users have to change their password.

4. Save your changes and close the file.

Example

The entry including default settings looks like this:

<add key="PasswordsExpirationDays" value="0"/> <!-- Days, default value: 0 -->