Configure

Sign-in and passwords🔗

These settings decide how long a user stays signed in, how many browsers an account can use at the same time, and what a password must look like. They are in the control panel under Security, which only the superuser can open.

The way users sign in — local accounts, LDAP, single sign-on — is chosen on the third page of the same section, Security → Authentication. See Authentication integration.

Sign-in policy🔗

The first four settings are on Security → Sign-in policy.

Require two-factor authentication🔗

Makes a second factor mandatory for every account. What users see when it is on, and how to require it for a single account instead, is described on Two-factor authentication.

Inactivity timeout🔗

Signs a user out after this number of minutes without activity. The default, 0, turns the timeout off, so users stay signed in until they sign out themselves.

Activity means using the interface: opening a page or a folder, previewing, editing or downloading a file, reading comments. A browser tab that stays open without being used does not count, so a user can be signed out while FileRun is still on the screen. Their next click leads to the sign-in page, with the message "Your authentication session has expired!".

The timeout applies only to browser sessions:

• People opening a shared link are not affected.
• App passwords, and the programs that use them, are not affected. See App passwords.

Even with the timeout at 0, a browser session does not last for ever. FileRun ends it six months after the sign-in.

Log user out when closing the browser🔗

With this option on, FileRun's session cookie has no expiry date, so the browser deletes it when it closes and the user has to sign in again the next time. With the option off, the cookie is kept for six months.

Browsers that are set to restore the previous session when they start often keep such cookies as well. The option works only as far as the browser allows.

The last login will end all other active browser sessions🔗

With this option on, signing in ends every other browser session of the same account. An account can then be signed in from one browser at a time: signing in on a second computer signs the first one out.

It does not affect WebDAV, the API, or the desktop and mobile apps. Those connections do not use browser sessions.

Other reasons a user is signed out🔗

No setting controls these:

• A browser update. A session is tied to the identification string the browser sends, and that string changes when the browser is updated. The user is asked to sign in again, with a message saying that this is probably due to a browser update.
• An unfinished sign-in. A sign-in that stops at the second-factor step is cancelled after 10 minutes.
• The user's own choice. Users can end any of their sessions under Account settings → Sessions. See Your account settings.

Passwords🔗

The password rules are on Security → Passwords.

Minimum password length🔗

The default is 8. The control panel recommends 12.

Passwords should not contain keyboard row sequences🔗

Refuses a password that contains a run of neighbouring keys:

• four letters next to each other on one row of the keyboard, such as qwer, asdf or zxcv
• four keys down one column of the keyboard, such as 1qaz or 2wsx
• three digits in a row, such as 123 or 789

Each run is also refused backwards, and upper and lower case make no difference, so rewq and ASDF are refused as well.

Only the QWERTY layout is checked. The rows of other layouts, such as azer or qwertz, are accepted.

Prevent user information to be used as part of the password🔗

Refuses a password that contains details of the account: the username, the e-mail address, the first or the last name, the company, the phone number or the website. The parts of the e-mail address are checked separately too, so for john.smith@example.com a password containing smith or example is refused.

Values shorter than three characters are not checked, and parts of the e-mail address shorter than four characters are not checked either, so com does not make every password invalid.

Note

FileRun does not compare passwords with a list of common or leaked passwords. None of the options on this page does that.

Rules that always apply🔗

Whatever the settings, a password cannot begin or end with a space or a tab, and it cannot be longer than 256 characters.

Where the rules apply🔗

The rules are checked every time a password is set:

• when a user changes their own password;
• when a user resets a forgotten password;
• when an administrator creates an account or sets a password on one;
• when a password is set on a shared link. A link has no account behind it, so only the length and the keyboard sequences are checked there, not the account details.

Changing the rules does not affect passwords that already exist. Users keep signing in with their current password, and the new rules apply the next time it is changed.

Password recovery🔗

Enable the "Forgot password?" option is on by default. It shows a Forgot password? link on the sign-in page. How the reset works is described on Two-factor authentication.

Turning it off removes the link and also refuses the reset itself, so it cannot be reached by typing its address either.

The link is never shown, whatever this option says, when an authentication plugin is active and Allow local user accounts to log in is off. The passwords then belong to the external system, and FileRun has none to reset.