Open topic with navigation
Security Settings
To prevent brute force attacks on activations and author user login attempts, SOLO Server performs velocity checks on these actions which automatically lock things out after a specified number of failed attempts within a given time frame. The settings for these velocity checks can be accessed through the through the Setup menu by choosing the Security Settings option. The settings are as follows:
Activation Settings:
The following settings apply to the velocity check performed by the activation process. This check will reject any activation for a given License ID or IP address, with settings for each configured independently.
- License Velocity Check Duration:
- The duration in minutes of the failure velocity check by License ID as well as the lockout period. Specify 0 to disable LicenseID velocity checking.
- License Velocity Check Count:
- The failure count that should not be exceeded for the License ID velocity check.
- IP Address Velocity Check Duration:
- The duration in minutes of the velocity check by IP address as well as the lockout period. Specify 0 to disable IP address velocity checking.
- IP Address Velocity Check Count:
- The failure count that should not be exceeded for the IP address velocity check.
- Activation Password Length:
- The length of system generated license activation passwords. Must be between 8 and 15.
Author Login Settings:
The following settings apply to the velocity check performed by the author login process. This check will reject any user login for a given User ID or IP address. For this check, the same settings apply to both the User ID and IP address checks.
- Author Login Velocity Check Duration:
- The duration in minutes of the failure velocity check as well as the lockout period. Specify 0 to disable velocity checking.
- Author Login Velocity Check Count:
- The failure count that should not be exceeded for the velocity check.
- Session Timeout:
- The number of minutes of inactivity allowed before online sessions are timed out and the user is forced to log back in.