Configuring password security

AOC provides the password security function to improve the security of your account. You can reduce the risk of malicious password cracking or leakage by setting password complexity, password age, and failed login attempt limit.

Password security factor	Configuration option	Impact
Password complexity	Low: The password must be at least 8 characters. Medium (default): The password must be at least 8 characters and contain at least one letter and one number. High: The password must be at least 8 characters and contain at least one uppercase letter, one lowercase letter, one number and one special character.	When creating a new user or changing the password for an existing user, the password complexity requirement must be met, otherwise the password cannot be set successfully.
Password age	Set the password age. The default is 90 days.	To improve the security of your account, it is recommended that you update your account password on a regular basis. If you do not update your password within the specified password age, the original password will be expired. In this case, the following situations will occur: If the account is logged in, it will be automatically logged out. If the account is not logged in, the next time you log in to AOC and enter the original password, the system will prompt that the password has expired and ask you to set a new password. Once the password is updated, the password age will reset and begin counting from zero.
Failed login attempt limit	Time limit: The time period for counting the number of failed login attempts. The default is 60 minutes. Threshold: The maximum number of failed login attempts allowed within the set time limit. The default is 5.	If the number of failed login attempts exceeds the set threshold within the specified time limit, your account will be locked for 30 minutes. During the lockout, you will not be able to log in even if you enter the correct password. If you need to unlock your account during the lockout, go reset the password: Reset by yourself: Verify your identity via security questions, then reset your password and unlock your account. Reset by administrator: Contact the administrator to help reset the password and unlock your account.

Password security factor

Configuration option

Impact

Password complexity

Low: The password must be at least 8 characters.
Medium (default): The password must be at least 8 characters and contain at least one letter and one number.
High: The password must be at least 8 characters and contain at least one uppercase letter, one lowercase letter, one number and one special character.

When creating a new user or changing the password for an existing user, the password complexity requirement must be met, otherwise the password cannot be set successfully.

Password age

Set the password age. The default is 90 days.

To improve the security of your account, it is recommended that you update your account password on a regular basis. If you do not update your password within the specified password age, the original password will be expired. In this case, the following situations will occur:

If the account is logged in, it will be automatically logged out.
If the account is not logged in, the next time you log in to AOC and enter the original password, the system will prompt that the password has expired and ask you to set a new password.

Once the password is updated, the password age will reset and begin counting from zero.

Failed login attempt limit

Time limit: The time period for counting the number of failed login attempts. The default is 60 minutes.
Threshold: The maximum number of failed login attempts allowed within the set time limit. The default is 5.

If the number of failed login attempts exceeds the set threshold within the specified time limit, your account will be locked for 30 minutes. During the lockout, you will not be able to log in even if you enter the correct password.

If you need to unlock your account during the lockout, go reset the password:

Reset by yourself: Verify your identity via security questions, then reset your password and unlock your account.
Reset by administrator: Contact the administrator to help reset the password and unlock your account.

Precaution

Users created from the LDAP/AD server are not restricted by password security configurations.

Procedure

In the left sidebar of the AOC System configuration page, click Password security.
Modify the Password complexity, Password age, and Failed login attempt limit configurations.
Click Save.