User Policy Settings

Authentication Order

Cerberus FTP Server can authenticate against several different types of data sources. The current possible authentication sources include the Native user system, Active Directory (AD), and LDAP.  You can have multiple AD and LDAP servers configured and Cerberus will checked each one and attempt to match a username and password.  Cerberus will try each authentication source in order until a successful authentication occurs or until all sources fail authentication.

The order that authentication sources are checked is determined by the Authentication Order list box. You can move authentication sources up and down in order depending upon your needs.

Authentication Requirements

The Disable Account and Password Storage Format options only apply to Cerberus Native accounts.

• Disable Account After x Failed Attempts - The Native account becomes disabled if x number of consecutive failed login attempts.  The counter is reset on a successful login.
• Password Storage Format - This is the method Cerberus uses to store password information.  Options are MD5, SHA1, SHA256, and SHA512.  All options are salted and are performed using FIPS compliant crypto routines if the server is in FIPS mode.
• Stop Authentication Chain if User Exists - If a user is found in an authentication source but the password is incorrect, don't proceed to check the other authentication sources.  Just fail the authentication request.

Password Complexity Requirements

These settings only apply to Cerberus Native accounts.

• Minimum Length - The password must be at least x characters long.
• Require at Least x Letters - The password must contain at least x count of letters.
• Require at Least x Numbers - The password must contain at least x count of numbers.
• Require at Least x Special Characters - The password must contain at least x count of special characters (ex, %, $, #).

Password Change Policy

These settings only apply to Cerberus Native accounts.

• Require Password Change Every X Days - The server will require that native account passwords be changed this number of days.
  • Applied to FTP - When checked, this policy is enforced for FTP/S account access. Note, FTP does not have a standard way of changing or prompting the user to change an account password.  Cerberus supports a common extension that allows changing the user password using the SITE PSWD oldpassword newpassword command.
  • Applies to SSH SFTP - When checked, this policy is enforced for SSH SFTP account access.  SSH has a standard method of allowing users to change their passwords but many SFTP clients do not implement it.
  • Applies to HTTP - When checked, this policy is enforced for HTTP/S account access.

Password History

These settings only apply to Cerberus Native accounts.

• Remember Last X Passwords - Cerberus will save a secure hash of the last specified number of passwords that the user has used.
• Can't Reuse Last X Passwords - Cerberus will prevent a user from changing their password to any password used within the specified history count.