Password Policies

7 minutes to read

Password policies help you define the structure and complexity of passwords to be used. You can either make use of the predefined policies or create new policies to suit the needs of your organization. Once you define the policy, PAM360 enforces that policy and reports on violations. The inbuilt password generator will generate passwords based on the policy defined.

This document walks you through the following topics:

  1. Default Password Policies
  2. Customizing Password Policies
  3. Creating your Own Password Policy
  4. Applying Password Policy to Resources in Bulk
  5. Enforcing Password Policy during Resource/Account Creation
  6. Enforcing Password Policy from General Settings

1. Default Password Policies

Password policy for PAM360 can be centrally managed from the Admin tab, Admin >> Resource Config >> Password policies. By default, PAM360 lists four policies and these policies cannot be edited or deleted. The default policies are:

  • Low - Password with less strict constraints.
  • Medium - Password with few strict constraints.
  • Strong - Password with strict constraints.
  • Offline password file - Policy for offline password access.

Apart from the default policies, you can also create your own password policy based on your requirements.

2. Customizing Password Policies

  1. Navigate to Admin >> Resource Config >> Password policies.
  2. You can select any of the policy as default policy by selecting the set as default icon against the desired policy.
  3. After setting default policy, if a user tries to change the password, the default policy will be enforced and the user will be forced to enter a password as per the policy.

3. Creating your Own Password Policy

  1. Navigate to Admin >> Resource Config >> Password policies.
  2. Click Add Policy.
  3. Enter the Policy Name and Description. You can also select from the existing templates and apply them here.
  4. Under Range & Character Set,
    1. Mention the Minimum (4) and Maximum (255) Length of the password.
    2. Select Enforce Numerals and mention the Minimum Count of numerals to be used in the password.
    3. Select Enforce Mixed Case and mention the Minimum Upper Case and Minimum Lower Case letters to be used in the password.
    4. Select Enforce Special Characters and mention the Minimum Count of characters to be used in the password. You can also mention the Characters not Allowed in the password.
  5. Under Words Usage,
    1. Select the checkbox, Password should not contain dictionary words to not allow dictionary words as the password. Example: apple, ranger, etc.
    2. You can also choose from the existing dictionaries. Click Manage to manage the dictionary files.
      1. In the pop-up that appears, mention Dictionary name, select the dictionary file (.txt) to be imported and click Add. You can add up to 5 dictionaries. Click here to download some of the recommended dictionaries.
      2. Select the checkbox Password should not contain obvious substitutions to not allow obvious substitutions. Example: @pple, r4nger, etc.
    3. Select the checkbox Enforce starting with an alphabet to allow only the passwords that begins with an alphabet. Example: Awed28.
    4. Select the checkbox Password should not contain login name to not allow username as password.
    5. Select the checkbox Password should not be an anagram of the login name to not allow password that is an anagram of username. Example: username: admin; password: dmain.
    6. Select the checkbox Password should not contain repeated substring to not allow password with repeated substrings. Example: testtest.
  6. Under Sequences,
    1. Select Password should not contain sequences of length to not allow a password with sequences and mention the sequence length.
    2. Select the checkbox to not allow Alphabet Sequence and their reverse as the password. Example: abcd, hgfe, etc.
    3. Select the checkbox to not allow Keyboard Sequence as the password. Click Change Layout to choose the layout of the keyboard. Example: qwerty, asdfg etc.
    4. Select the checkbox to not allow Numeric Sequence and their reverse as the password. Example: 1234,8765, etc.
    5. Select the checkbox to not allow Consecutive Sequence of letters, numbers or symbols as the password. Example: aaa, 111, &&&, etc.
  7. Under Password Similarity,
    1. Tick the Password should not be same as last checkbox to restrict the previously used passwords as desired. You can restrict up to 100 previously used passwords.
    2. Tick the Password should not be very similar to last checkbox to restrict passwords similar to previously used passwords. You can check and restrict up to 10 previously used passwords. Example: anem28, bnem28.
  8. Under Password Age, tick the Expire password after --- days checkbox and mention the number of days after which the password should expire.
  9. Click the Generate Password icon to generate a sample password with the selected constraints.
  10. Click Preview to preview the selected password constraints.
  11. Click Save to apply the changes.

Now, you have successfully created your own password policy based on your requirement.

4. Applying Password Policy to Resources in Bulk

  1. Navigate to the Resources tab.
  2. Select the resources for which you wish to apply the same password policy.
  3. Click Resource Actions and select Associate Password Policy from the dropdown.
  4. In the dialog box that appears, select the Password policy to be applied to the chosen resource(s) from the dropdown and Click Save.

After the completion of selection of password policy, the chosen password policy will be applied to all the selected resources in bulk. In case, any of the chosen resources had already been with a password policy, this action would simply overwrite the previous policy.

5. Enforcing Password Policy during Resource/Account Creation

In normal scenarios, PAM360 can check the passwords stored in the repository for compliance to the policy specified and report violations. If you want to enforce the password policy at the time of creation itself, you need to switch on a configuration in General Settings. To know more about general settings, click here.

6. Enforcing Password Policy from General Settings

  1. Navigate to Admin >> Settings >> General settings.
  2. In the UI that opens with a list of options, select Resource / Password Creation from the left pane.
  3. By default password policy gets enforced only at the time of password change. If you wish to enforce policy compliance at the time of resource or account addition itself, then click the checkbox Enforce password policy during resource or password creation.
  4. Once you click this, you will be permitted to add your resource or account only if the password is in accordance with the policy defined.
Top
Back to Top