Password policy in Thulium
Introduction#
In the Thulium system, the Administrator can configure policies regarding user password security. These include, among others, enforcing periodic password changes, checking password strength, and the option to enable two-factor authentication.
Enforcing periodic password change#
The system administrator can set the parameter Number of days after which a password change is enforced in the system, available in the system parameters.
The parameter specifies how often users must change their password:
- value 0 – password change is not enforced,
- value > 0 – after the specified number of days, the system will prompt the user to set a new password.
Checking password strength#
When setting a password, the system checks its security using the zxcvbn library.
The library analyzes, among others:
- password length,
- predictability of patterns,
- use of popular words or schemes.
In the Thulium system, a security level of score = 3 is required, which means the password is hard to guess (up to 10 billion attempts) and provides protection even in case of offline password cracking.
Checking password similarity to user data#
To prevent the use of easy-to-guess passwords, the system also checks their similarity to user data such as:
- first name,
- last name,
- login,
- email address,
- system name.
If the similarity of the password to these data exceeds 70%, the system will not allow its use.
Secure passwords are one of the fundamental elements of protecting access to systems like Thulium. Passwords that are too simple or easy to guess can be quickly cracked by automated tools used in brute force attacks or using leaked password databases.
Using strong passwords, changing them regularly, and additional protections—such as two-factor authentication—significantly reduce the risk of unauthorized access to user accounts and data stored in the system.