These settings decide how long a user stays signed in, how many browsers an account can use at the same time, and what a password must look like. They are in the control panel under Security, which only the superuser can open.
The way users sign in — local accounts, LDAP, single sign-on — is chosen on the third page of the same section, Security → Authentication. See Authentication integration.
The first four settings are on Security → Sign-in policy.
Makes a second factor mandatory for every account. What users see when it is on, and how to require it for a single account instead, is described on Two-factor authentication.
Signs a user out after this number of minutes without activity. The default, 0, turns the
timeout off, so users stay signed in until they sign out themselves.
Activity means using the interface: opening a page or a folder, previewing, editing or downloading a file, reading comments. A browser tab that stays open without being used does not count, so a user can be signed out while FileRun is still on the screen. Their next click leads to the sign-in page, with the message "Your authentication session has expired!".
The timeout applies only to browser sessions:
Even with the timeout at 0, a browser session does not last for ever. FileRun ends it six months
after the sign-in.
With this option on, FileRun's session cookie has no expiry date, so the browser deletes it when it closes and the user has to sign in again the next time. With the option off, the cookie is kept for six months.
Browsers that are set to restore the previous session when they start often keep such cookies as well. The option works only as far as the browser allows.
With this option on, signing in ends every other browser session of the same account. An account can then be signed in from one browser at a time: signing in on a second computer signs the first one out.
It does not affect WebDAV, the API, or the desktop and mobile apps. Those connections do not use browser sessions.
No setting controls these:
Account settings →
Sessions. See Your account settings.The password rules are on Security → Passwords.
The default is 8. The control panel recommends 12.
Refuses a password that contains a run of neighbouring keys:
qwer, asdf or zxcv1qaz or 2wsx123 or 789Each run is also refused backwards, and upper and lower case make no difference, so rewq and
ASDF are refused as well.
Only the QWERTY layout is checked. The rows of other layouts, such as azer or qwertz, are
accepted.
Refuses a password that contains details of the account: the username, the e-mail address, the first
or the last name, the company, the phone number or the website. The parts of the e-mail address are
checked separately too, so for john.smith@example.com a password containing smith or example
is refused.
Values shorter than three characters are not checked, and parts of the e-mail address shorter than
four characters are not checked either, so com does not make every password invalid.
FileRun does not compare passwords with a list of common or leaked passwords. None of the options on this page does that.
Whatever the settings, a password cannot begin or end with a space or a tab, and it cannot be longer than 256 characters.
The rules are checked every time a password is set:
Changing the rules does not affect passwords that already exist. Users keep signing in with their current password, and the new rules apply the next time it is changed.
Enable the "Forgot password?" option is on by default. It shows a Forgot password? link on the
sign-in page. How the reset works is
described on Two-factor authentication.
Turning it off removes the link and also refuses the reset itself, so it cannot be reached by typing its address either.
The link is never shown, whatever this option says, when an authentication plugin is active and
Allow local user accounts to log in is off. The passwords then belong to the external system, and
FileRun has none to reset.