You can protect the Site Factory Management Console or any websites that use OpenID accounts by configuring the following security settings:
Site Factory subscribers provisioned after the release of Site Factory 2.78 are limited to two concurrent sessions per user. If a user is signed in to two concurrent sessions and signs in to a third concurrent session without signing out from one of the two existing sessions, the session with the longest idle time will be signed out.
If Acquia provisioned your Factory before the release of Site Factory 2.78, contact Acquia Support to request this feature be enabled on your account.
You can specify a security policy for passwords to access the Site Factory Management Console or any of your websites that use OpenID accounts. The password security policy determines how strong (or resistant to guessing) user passwords must be for Site Factory to accept them.
Note
Regardless of your password security policy settings, Site Factory requires a minimum password length of seven (7) characters for Site Factory Management Console and OpenID accounts.
Password strength policies enforce rules about passwords to prevent them from
being easily compromised or guessed by another person. At their most basic
level, these policies can only require passwords to include at least one
number, an uppercase letter, and a lowercase letter. This policy doesn’t
actually result in hard-to-guess passwords; for example, the password
Passw0rd
satisfies the rule, but isn’t a strong password.
Instead of a basic approach, the Site Factory password strength system applies a combination of rules to rank how difficult the password is to guess. For example, the following examples decrease an entered password’s strength ranking:
4
or @
for a
, and 5
for s
.
These substitutions are treated as only slightly stronger than the words
themselvesabcde
or 12345
)qwerty
or zaq1
)1111
)1921
or 19-11-1978
)The password strength policy prohibits users from using their Acquia accounts’ email address as a password.
The password strength levels assigned to passwords are based on the following:
The estimated time-to-crack at each level is about two orders of magnitude greater than the next lower level, so a Weak password can take minutes to crack, while a Very Strong password can take years.
Weak passwords
For example, these passwords are weak:
mystrongpassword
: Dictionary wordsel1z@b3th
: Common name, with leet substitutions11121957
: Date9876598765
: Keyboard sequencesStrong passwords
A password can rank as extremely strong even if it consists of only elements like those described here, as long as it has enough distinct elements and is long enough.
For example, these passwords are strong:
correctdonkeybatterystaple
: Long password (even though it has four
dictionary words)Actions>words
: Long password9a8b7c6d5e
: Long password without keyboard patternsFor inspiration, see this XKCD comic. For a method for creating strong passwords consisting of randomly chosen short words, see the Diceware Passphrase Home Page, or password managers such as LastPass, 1Password or KeePassX.
To enable or change the password strength policy for the Site Factory Management Console and for your websites that use OpenID accounts, complete the following steps:
You can also directly change the password strength policy for your Stage environment.
Although you can use the previous password strength policy procedure to change your Stage environment’s policy, each time you stage websites from your Prod environment to your Stage environment, your Factory settings are also copied with your websites. This staging includes your Prod environment’s password strength policy settings, overwriting your Stage environment’s policies.
After you enable a password strength policy, Site Factory Management Console account and OpenID user passwords are tested for their strength during sign-in. If a password fails to meet the policy, the user isn’t permitted access, and is then prompted to change the password to one satisfying the policy’s strength requirement.
As a user types a new password, Site Factory tests and reports the password’s strength. When users create passwords not satisfying the password strength policy, Site Factory displays an error message describing the reasons the password can’t be accepted. For example:
The following issues were detected with your password:
* Contains dictionary words (e.g. "password")
When changing your password, Site Factory provides information about acceptable password requirements following the Confirm password field.
You can enable two-factor authentication (also known as two-step verification) to control access to your subscription through the Site Factory Management Console. Two-factor authentication is more secure than password authentication alone. With two-factor authentication enabled, a user signing in to the Site Factory Management Console or a website using OpenID accounts must supply an user email address, a password, and also a code sent to a trusted device.
Note
This page describes how to require two-factor authentication for all user accounts. For information about how to sign in with two-factor authentication, see Configuring two-factor authentication for your Site Factory account.
To change your Factory two-factor authentication settings, complete the following steps:
To better secure your hosted websites, you can configure Site Factory to sign users out of websites after a configurable period of inactivity. This configuration helps to protect accounts from unauthorized use if a user leaves a browser window open and unattended.
Note
Site Factory subscriptions provisioned after the release of Site Factory 2.81 on October 10, 2018 are configured by default to sign out inactive user accounts after 15 minutes (900 seconds).
To change how Site Factory handles inactive users, complete the following steps:
900
in the field will sign out users after 15
minutes of inactivity.To better secure your websites, you can block inactive accounts after a specified number of days of inactivity. Blocking inactive accounts helps protect accounts from unauthorized use if a malicious user discovers and accesses an abandoned account.
To configure the disabling of inactive accounts, complete the following steps:
Site Factory administrators can use the Site Factory Management Console or the Site Factory API to reset API keys of an individual user, or all users. Users can also reset their own API key. For more information, see Resetting API keys on Site Factory.