Configure PoolParty to Use Stronger Passwords

The following key determines, if users on logging in to PoolParty for the first time have to change their password or not:

Default behaviour: new users and legacy users will have to change passwords on their first login. At that point a user after logging in cannot execute any functions, until he or she has changed their password. That way a password is less apt to be abused.

To configure PoolParty to require stronger password security add the following setting to the poolparty.properties file:

If stronger password security is set, passwords have to match the following criteria:

The periodical password change policy is meant to prevent an attacker to guess or otherwise find out a password. The change can be set to a value of your choice in days, default is 90 for as many days.

Set the following value in the poolparty.properties file:

This setting enforces a password change for users after 90 days, periodically. At that point a user after logging in cannot execute any functions, until he or she has changed their password.

This makes sure that users cannot reuse their passwords. Changing this value in the poolparty.properties file sets the number of passwords for a user saved in a history. In this example, the user cannot use the last 10 passwords:

Number of allowed login attempts before lock-out.

To enable user account locking, the following settings can be used in the poolparty.properties file:

The user management allows to unlock an account. It's also possible to use ReCaptcha. In the unusual event that all accounts are locked, security.account.lock should be removed from the property file and PoolParty restarted. After that the lock is no longer active.