Password & Login Security — User Guide

Framework: AtoM Heratio >= 2.8.0 Services: PasswordPolicyService, LoginSecurityService, AuthMiddleware

Introduction

AtoM Heratio includes built-in password and login security features that protect user accounts from unauthorized access. These features work automatically once the database tables are installed, and can be configured via Admin > AHG Settings.

Password Expiry

User passwords expire after a configurable number of days. When a password is nearing expiry or has expired, the system notifies the user automatically.

How It Works

1. Each time a user changes their password, the change is recorded in the password history
2. On each login, the system checks the age of the user's last password change
3. If nearing expiry, a warning banner appears (e.g., "Your password will expire in 7 days")
4. If expired, an error banner appears prompting immediate password change
5. If Force Password Change is enabled, the user is redirected to the password change page and cannot access other pages until the password is updated

Settings

Password Reuse Prevention

The system prevents users from reusing recent passwords. When a user attempts to change their password to one they have used before, the change is rejected with a clear error message.

How It Works

1. A configurable number of previous password hashes are stored per user
2. When the user submits a new password, it is checked against the stored history
3. If the new password matches any recent password, the form displays: "This password has been used recently. Please choose a different password."
4. The user must choose a different password to proceed

Settings

Login Lockout (Brute-Force Protection)

The system automatically locks out login attempts after too many consecutive failures, protecting against brute-force password guessing attacks.

How It Works

1. Each login attempt (successful or failed) is recorded with the email address and IP
2. After 5 failed attempts within 15 minutes, the account is temporarily locked
3. The login form displays: "Too many failed login attempts. Please try again in X minute(s)."
4. After the lockout period (15 minutes), the user can try again
5. A successful login clears all previous failure records for that email
6. Old attempt records (older than 24 hours) are cleaned up automatically

Policy

Strong Password Requirements

When Require Strong Passwords is enabled in AtoM settings, the password change form enforces minimum strength requirements:

• Minimum 6 characters
• Must contain lowercase letters
• Must contain uppercase letters
• Must contain numbers
• Must contain punctuation
• Must not be the same as the username

A visual password strength meter is displayed on the password change page.

To enable: set require_strong_passwords to true in apps/qubit/config/app.yml.

Settings Configuration

Password security settings are stored in the ahg_settings table. Administrators can configure them via Admin > AHG Settings > Security (if the settings section is available), or by inserting values directly:

-- Example: Set password expiry to 60 days
INSERT INTO ahg_settings (setting_key, setting_value, setting_group)
VALUES ('password_expiry_days', '60', 'security')
ON DUPLICATE KEY UPDATE setting_value = '60';

-- Example: Enable forced password change on expiry
INSERT INTO ahg_settings (setting_key, setting_value, setting_group)
VALUES ('security_force_password_change', 'true', 'security')
ON DUPLICATE KEY UPDATE setting_value = 'true';

-- Example: Remember last 10 passwords
INSERT INTO ahg_settings (setting_key, setting_value, setting_group)
VALUES ('password_history_count', '10', 'security')
ON DUPLICATE KEY UPDATE setting_value = '10';

Database Tables

The security features require three tables (created during framework installation):

These tables are created automatically by the framework installer. If they are missing, the security features gracefully degrade — login and password changes work normally without enforcement.

Troubleshooting

The Archive and Heritage Group (Pty) Ltd