Security Hardening

<div class="panelMacro"><table class="noteMacro"><colgroup><col width="24"><col></colgroup><tbody><tr><td valign="top"><img width="16" height="16" border="0" align="absmiddle" alt="" src="/images/icons/emoticons/warning.png"></td><td><p><strong>NOTE:</strong> <strong>The value of <span class="keyword">PasswordComplexity</span> must always be 8 characters, otherwise the policy will not be implemented.</strong> The order of each Type pair (Type character and amount character) is not important.</p></td></tr></tbody></table></div>

<h2>Automatic expiry of Web user passwords</h2>

<p>You can force Web users to change the password after a predetermined age has been set. Note that this is a system wide setting.</p>

<p>The server running TIM Enterprise will email the web user advising 
that a password change is required. The web user must have an email 
address configured for notification to take place.</p>

<p>If the password is not changed by the expiry date then the account is automatically disabled.</p>

<table class="confluenceTable">
	<tbody>
		<tr>
			<th class="confluenceTh" width=166>Registry String data value</th>
			<th class="confluenceTh">Description</th>
		</tr>
  		<tr>
    		<td class="confluenceTd"><span class="keyword">PasswordExpiryTimeUnits</span></td>
    		<td class="confluenceTd">Determines the time units that the related expiry entries (below) will use.&nbsp; Valid values are "minutes", "hours", "days", "weekdays"</td>
  		</tr>
  		<tr>
    		<td class="confluenceTd"><span class="keyword">PasswordExpiryReminder</span></td>
    		<td class="confluenceTd">A value, in the units described by the "PasswordExpiryTimeUnits" entry, after which an email is sent to the web user to remind them to change their password.</td>
  		</tr>
 		 <tr>
    		<td class="confluenceTd"><span class="keyword">PasswordExpiryDisable</span></td>
    		<td class="confluenceTd">A value, in the units described by the "PasswordExpiryTimeUnits" entry, which specifies how long after the reminder email (above) is sent, that a web user's account will be disabled if it hasn't been updated.</td>
  		</tr>
	</tbody>
</table>

<p>Default values for the above settings are as follows:-</p>

<ul>
  <li><span class="keyword">PasswordExpiryTimeUnits</span> = "days"</li>
  <li><span class="keyword">PasswordExpiryReminder</span> = "7"</li>
  <li><span class="keyword">PasswordExpiryDisable</span> = "7"</li> 
</ul>

<p>Therefore, using the default settings, a web user will receive an 
email reminder after 7 days. The account will be disabled after 14 days 
(7 plus 7).</p>

<p>If the "PasswordExpiryReminder" value is zero then password 
reminder functionality is disabled and neither a reminder email will be 
sent, nor will a web user's account be disabled. Since this value has a 
default of "7", this value must be explicitly set to zero to disable 
password reminder functionality.</p>

<p>If the "PasswordExpiryDisable" value is explicitly set to zero, the disabling of a web user's account is skipped.</p>

<table class="confluenceTable">
	<tbody>
		<tr>
			<th class="confluenceTh" width=166>Registry String data value</th>
			<th class="confluenceTh">Description</th>
		</tr>
  		<tr>
    		<td class="confluenceTd"><span class="keyword">PasswordReminderSubject</span></td>
    		<td class="confluenceTd">"Password reset notification"</td>
  		</tr>
  		<tr>
    		<td class="confluenceTd"><span class="keyword">PasswordReminderMessage</span></td>
    		<td class="confluenceTd">"Your password to access the [%productname%] service will 
				expire in <%expiryamount%> <%expiryunits%>.\r\n You should 
				log in to the service before <%expirydate%> to reset your 
				password, otherwise your account will be disabled"</td>
  		</tr>
	</tbody>
</table>

<p>The following <%%> variables are permissible in both the subject  and the body text of the reminder email message:-</p>

<table class="confluenceTable">
	<tbody>
		<tr>
			<th class="confluenceTh" width=166><%%> variable</th>
			<th class="confluenceTh">Description</th>
		</tr>
  		<tr>
    		<td class="confluenceTd"><span class="keyword"><%product%></span></td>
    		<td class="confluenceTd">The name of the product eg. TIM Enterprise</td>
  		</tr>
  		<tr>
    		<td class="confluenceTd"><span class="keyword"><%expiryunits%></span></td>
    		<td class="confluenceTd">The value of <span class="keyword">PasswordExpiryTimeUnits</span></td>
  		</tr>
 		 <tr>
    		<td class="confluenceTd"><span class="keyword"><%expirydate%></span></td>
    		<td class="confluenceTd">A computed date of the above values relative to the date that the email was sent at, in local date/time format.</td>
  		</tr>
	</tbody>
</table>