You can protect the Site Factory Management Console or any websites that use OpenID accounts by configuring the following security settings:

• Session concurrency limit

• Minimum password strength

• Two-factor authentication

• Controlling when idle users are signed out

• Disabling inactive accounts

• Resetting user API keys

Session concurrency limit

Site Factory subscribers provisioned after the release of Site Factory 2.78 are limited to two concurrent sessions per user. If a user is signed in to two concurrent sessions and signs in to a third concurrent session without signing out from one of the two existing sessions, the session with the longest idle time will be signed out.

If Acquia provisioned your Factory before the release of Site Factory 2.78, contact Acquia Support to request this feature be enabled on your account.

Minimum password strength

You can specify a security policy for passwords to access the Site Factory Management Console or any of your websites that use OpenID accounts. The password security policy determines how strong (or resistant to guessing) user passwords must be for Site Factory to accept them.

Determining a password’s strength

Password strength policies enforce rules about passwords to prevent them from being easily compromised or guessed by another person. At their most basic level, these policies can only require passwords to include at least one number, an uppercase letter, and a lowercase letter. This policy doesn’t actually result in hard-to-guess passwords; for example, the password Passw0rd satisfies the rule, but isn’t a strong password.

Instead of a basic approach, the Site Factory password strength system applies a combination of rules to rank how difficult the password is to guess. For example, the following examples decrease an entered password’s strength ranking:

• Words found in a dictionary of common words, common first and last names, or common passwords

• Words found in the dictionary, but with common 1337 (or leet) substitutions, such as 4 or @ for a, and 5 for s. These substitutions are treated as only slightly stronger than the words themselves

• Common sequences of letters or numbers (abcde or 12345)

• Characters in a keyboard pattern (qwerty or zaq1)

• Three or more repeated characters (1111)

• Dates or years (1921 or 19-11-1978)

The password strength policy prohibits users from using their Acquia accounts’ email address as a password.

The password strength levels assigned to passwords are based on the following:

• The amount of entropy (randomness) in each password.

• An estimate of the amount of time needed to determine (or crack) each password using a brute force attack (based on current estimations).

The estimated time-to-crack at each level is about two orders of magnitude greater than the next lower level, so a Weak password can take minutes to crack, while a Very Strong password can take years.

Password examples

• Weak passwords

  For example, these passwords are weak:

  • mystrongpassword: Dictionary words

  • el1z@b3th: Common name, with leet substitutions

  • 11121957: Date

  • 9876598765: Keyboard sequences

• Strong passwords

  A password can rank as extremely strong even if it consists of only elements like those described here, as long as it has enough distinct elements and is long enough.

  For example, these passwords are strong:

  • correctdonkeybatterystaple: Long password (even though it has four dictionary words)

  • Actions>words: Long password

  • 9a8b7c6d5e: Long password without keyboard patterns

Resources for creating strong passwords

For inspiration, see this XKCD comic. For a method for creating strong passwords consisting of randomly chosen short words, see the Diceware Passphrase Home Page, or password managers such as LastPass, 1Password or KeePassX.

Setting the password strength policy

To enable or change the password strength policy for the Site Factory Management Console and for your websites that use OpenID accounts, complete the following steps:

• Sign in to your Prod environment’s Site Factory Management Console using an account with the platform admin role.

• In the admin menu, click Administration, and then click the Security settings link.

• In the Minimum required password strength section, select the minimum required strength from the following values:

  • disabled: Passwords can have any password strength ranking (but must still be seven characters or longer)

  • weak: Passwords must have a password strength ranking of weak or greater

  • good: Passwords must have a password strength ranking of good or greater

  • strong: Passwords must have a password strength ranking of strong or greater

  • very strong: Passwords must have a password strength ranking of very strong or greater

• Click Save configuration.

Stage environment password strength policies

You can also directly change the password strength policy for your Stage environment.

Although you can use the previous password strength policy procedure to change your Stage environment’s policy, each time you stage websites from your Prod environment to your Stage environment, your Factory settings are also copied with your websites. This staging includes your Prod environment’s password strength policy settings, overwriting your Stage environment’s policies.

Transitioning to stricter password policies

After you enable a password strength policy, Site Factory Management Console account and OpenID user passwords are tested for their strength during sign-in. If a password fails to meet the policy, the user isn’t permitted access, and is then prompted to change the password to one satisfying the policy’s strength requirement.

As a user types a new password, Site Factory tests and reports the password’s strength. When users create passwords not satisfying the password strength policy, Site Factory displays an error message describing the reasons the password can’t be accepted. For example:

The following issues were detected with your password:
* Contains dictionary words (e.g. "password")

When changing your password, Site Factory provides information about acceptable password requirements following the Confirm password field.

Two-factor authentication

You can enable two-factor authentication (also known as two-step verification) to control access to your subscription through the Site Factory Management Console. Two-factor authentication is more secure than password authentication alone. With two-factor authentication enabled, a user signing in to the Site Factory Management Console or a website using OpenID accounts must supply an user email address, a password, and also a code sent to a trusted device.

To change your Factory two-factor authentication settings:

• Sign in to your Prod environment’s Site Factory Management Console using an account with the platform admin role.

• In the admin menu, click Administration, and then click the Security settings link.

• In the Two-step verification section, select either Required or Not required to indicate whether Factory accounts and website accounts using OpenId must use two-factor authentication or not, respectively.

• Click Save configuration.

Controlling when idle users are signed out

To better secure your hosted websites, you can configure Site Factory to sign users out of websites after a configurable period of inactivity. This configuration helps to protect accounts from unauthorized use if a user leaves a browser window open and unattended.

To change how Site Factory handles inactive users, complete the following steps:

• Sign in to your Prod environment’s Site Factory Management Console using an account with the platform admin role.

• In the admin menu, click Administration, and then click the Security settings link.

• In the Automatic logout settings section, select the Sign out inactive user accounts checkbox to sign out inactive users, or clear the checkbox to allow inactive users to remain signed in to your websites indefinitely.

• If the Sign out inactive user accounts checkbox is enabled, in the Time in seconds field, enter the number of seconds a user may be inactive before being signed out. For example, entering 900 in the field will sign out users after 15 minutes of inactivity.

• Click Save configuration.

Disabling inactive accounts

To better secure your websites, you can block inactive accounts after a specified number of days of inactivity. Blocking inactive accounts helps protect accounts from unauthorized use if a malicious user discovers and accesses an abandoned account.

To configure the disabling of inactive accounts:

• Sign in to your Prod environment’s Site Factory Management Console using an account with the platform admin role.

• In the admin menu, click Administration, and then click the Security settings link.

• In the Automatic disabling of inactive accounts section, select the checkbox to disable accounts, and enter the number of days to preserve inactive accounts in the Disable after field.

• Click Save configuration.

Resetting user API keys

Site Factory administrators can use the Site Factory Management Console or the Site Factory API to reset API keys of an individual user, or all users. Users can also reset their own API key. For more information, see Resetting API keys on Site Factory.

Modifying your security settings

The following issues were detected with your password:
* Contains dictionary words (e.g. "password")