---
title: "Enhance password security"
slug: "enhance-password-security"
updated: 2026-11-02T08:54:47Z
published: 2026-11-02T08:54:47Z
canonical: "docs.grassfish.com/enhance-password-security"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.grassfish.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enhance password security

You can improve account protection in IXM One by applying a few simple security rules.

These settings can significantly strengthen password security and reduce the risk of unauthorized access.

## Apply the four-eyes principle

To increase security when creating administrator accounts, the four-eyes principle applies.

This means that creating a new admin account requires confirmation from a second admin user. This ensures that no single user can create or assign administrative privileges alone.

The respective setting in the `master.config` file is enabled by default.

```xml
<add key="FourEyesPrincipleEnabled" value="true"/>
```

> [!NOTE]
> Note
> 
> We recommend leaving the four-eyes principle enabled. Disabling it would compromise security.

## Ensure brute force protection

Brute force protection helps prevent automated or dictionary-based login attacks.

When users repeatedly enter incorrect passwords, their account is temporarily blocked by default before they can try again:

- **3 failed attempts**: Blocked for 30 seconds
- **4 failed attempts**: Blocked for 60 seconds
- **Further failed attempts**: Blocked for 120 seconds

You can adjust these settings if needed. To do so, perform the following steps:

1. Open the `master.config` file.
2. Go to the **Main** section.
3. Edit the following settings:
  - **LoginBanAutoResetDurationMinutes**: Specify how long a user remains blocked after multiple failed login attempts (default: 5 minutes).
  - **LogSuccessfulLogins**: To record successful logins set this setting to **true**.
4. Save your changes and close the file.

**Example**

The entries including default settings look like this:

```xml
<add key="LoginBanPeriodsSeconds" value="0, 0, 0, 30, 60, 120"/>
<add key="LoginBanAutoResetDurationMinutes" value="5"/>
<add key="LogSuccessfulLogins" value="false"/>
```

## Set password expiry

To ensure users update their password regularly, you can enforce password expiration. This forces users to change their password after a specified time period.

You can adjust this settings if needed. To do so, perform the following steps:

1. Open the `master.config` file.
2. Go to the **Main** section.
3. Set the value of **PasswordExpirationDays** to the number of days after which users have to change their password.
4. Save your changes and close the file.

**Example**

The entry including default settings looks like this:

```xml
<add key="PasswordsExpirationDays" value="0"/> <!-- Days, default value: 0 -->
```