Policy Settings

Password Complexity Requirements

These settings only apply to native accounts. 

Minimum Length The password must be at least x characters long.
Require at Least x Letters The password must contain at least x count of letters.
Require at Least x Uppercase Letters The password must contain at least x count of uppercase letters.
Require at Least x Lowercase Letters The password must contain at least x count of lowercase letters.
Require at Least x Numbers The password must contain at least x count of numbers.
Require at Least x Special Characters The password must contain at least x count of special characters (ex, %, $, #).

Password Change Policy

Require Password Change Every X Days 

The server will require that native account passwords be changed after this number of days. Not all protocols have standard support for password changing, and not all clients implement that support when it does exist. To overcome this limitation, you can disable password expiration checking for specific protocols. Note, marking a user account password as requiring a change on the next login requires the password change option to be checked.

• Applies to FTP – When checked, this policy is enforced for FTP/S account access. Note, FTP does not have a standard way of changing or prompting the user to change an account password.  Cerberus supports a common extension that allows changing the user password using the command.

  SITE PSWD oldpassword newpassword

  However, using that command requires the user to be logged in. The protocol does not have a mechanism for informing the user of an expired password during login. As a result, there is no way to change an expired password via FTP once it has expired. The user will be unable to login via FTP.
• Applies to SSH SFTP – When checked, this policy is enforced for SSH SFTP account access.  SSH has a standard method of allowing users to change their passwords, but many SFTP clients do not implement it.
• Applies to HTTP – When checked, this policy is enforced for HTTP/S account access. Cerberus handles the logic of making sure the user is properly prompted for changing an expired password during login, so this method is supported by all web browsers.

Password History 

Remember Last X Passwords Cerberus will save a secure hash of the last specified number of passwords that the user has used.
Can’t Reuse Last X Passwords Cerberus will prevent a user from changing their password to any password used within the specified history count.

Authentication Order

 Cerberus FTP Server can authenticate against several different types of data sources. The current possible authentication sources include the Native user system, Active Directory (AD), and LDAP.  You can have multiple AD and LDAP servers configured and Cerberus will check each one and attempt to match a username and password.  Cerberus will try each authentication source in order until a successful authentication occurs, or until all sources fail authentication.

The order that authentication sources are checked is determined by the Authentication Order list box. You can move authentication sources up and down in order depending upon your needs.

Authentication Requirements

The Disable Account and Password Storage Format options only apply to Cerberus Native accounts.

Disable Account After Too Many Failed Attempts The Native account becomes disabled if x number of consecutive failed login attempts.  The counter is reset on a successful login.

Disable Account Last Login Exceeded Native accounts become disabled if they exceed x number of days without successful login

.Password Storage Format This is the method Cerberus uses to store user account password information.  Options are SHA1, SHA256, and SHA512, PBKDF2 HMAC SHA256, and PBKDF2 HMAC SHA256.  All options are salted and are performed using FIPS-compliant crypto routines if the server is in FIPS mode.

Stop Authentication Chain if User Exists If a user is found in an authentication source, but the password is incorrect, don’t proceed to check the other authentication sources.  No other authentication sources will be checked if the user is found and the password is incorrect.

Auto-Create Variable Directories The variable %USER% can be used in virtual directory names and paths. This variable is evaluated to the account’s name when the user logs in. Selecting this option ensures that virtual directory paths with the %USER% variable in them will be automatically created when the user account is evaluated during login.

Create Home Directory As User For AD This setting influences how home directories are created for Active Directory users when the default virtual directory mapping mode in AD is set to Global Home/%USER% mode. Normally, Cerberus creates the home directory while under the service account. If this option is enabled, Cerberus will impersonate the AD user before creating the directory. This ensures the home directory is owned by the AD user instead of the service account.

Use UPN for Home Directory for AD This setting influences how home directories are created for Active Directory users when the default virtual directory mapping mode in AD is set to Global Home/%USER% mode. If this option is checked, Cerberus will always use the AD user’s UPN name as the home directory name, instead of the user’s login name. AD users can usually use either their SAMAccount or their UPN name. Checking this option will ensure the user is always placed in the same home directory, regardless of whether they log in with their SAMAccount or UPN name.

Follow Active Directory Referrals When querying a domain controller, a referral is a way that a directory server communicates that it does not contain the data required to complete a query, but has a reference to a server that may contain the required data. If this option is selected, Cerberus will query other domain controllers to get a complete set of results.