<< Click to display Table of Contents >> Navigation:  IT-Security & Audit > Encryption & Password Security

Encryption - General Information

 

The Infoserver is able to apply advanced encryption methods on passwords and TCP communication (SSL). In the default configuration, only the password encryption is active, meaning that passwords saved in the Infoserver.ini and the database are encrypted as well as login-data submitted on the administration website. The default encryption-method is an RIJ (Rijndael/AES: symmetric encryption) algorithm with fixed key-length of 128 bit.

 

Additionally, it is possible to activate encrypted communications (SSL) for HTTP (Infoclient connections and administration website). Since SSL demands some sort of certification, the Infoserver can either create self-signed certificates or can use certificates issued by a certification authority.

 

Password Security

 

All admin and domain passwords used by the Infoserver are saved encrypted . Roles must use their domain password for logging in. The passwords of Roles are not saved in the Infoserver, but a compare-request is sent to the domain and a successfull login is only granted, if an "OK" is returned. The login in the administration interface is encrypted as well, meaning that the user-credentials are encrypted before sending them to the Infoserver.

 

The Admin passwords (Login & MailToInfo) as well as the password for access to the Native Domain are saved encrypted in the configuration file. The admin's password can only be decrypted by the Infoserver. The admin's password can be edited in the Infoserver administration website. For editing the admin's password please check the chapter Password.

 

In case the Infoserver admin password was lost or is unknown, then you can reset the password by changing the encrypted value back to the standard password of the admin (bestinformed) in the configuration-file Infoserver.ini and restarting the Cordaware_bestinformed_best_web service thereafter.

 

 

Passwords of the domain admins are saved encrypted in the Infoserver database and can only be decrypted by the Infoserver. These passwords can only be edited from the administration interface of the Infoserver. A reset in the database is only possible for those users, which have access to the database and the right to write to the appropriate table. Please note that tampering with any data in the database is at your own risk!

 

Therefore, passwords are saved and encrypted in the database. For the domain-administration, the user and his password can be set up in the domain solely for Cordaware bestinformed for avoiding the use of a productive user.

 

 

2FA - Two-Factor Authentication

 

You can verify the identity of users logging into the Cordaware bestinformed web interface using Two-Factor Authentication (2FA). This process utilizes the OTP (One-Time Password) method. Below you will find instructions for activation, user setup, and an overview of all configuration options.

 

1.Administrative Activation (Global)
The admin can activate 2FA in the app System > System (global) within the General section. Enable the checkbox Two-factor authentication: Active / Webinterface and click Save to apply the changes.
 

 
If this option is deactivated, two-factor authentication will be discontinued for all affected users.
 

 

 

2.User Setup
Following global activation, each user can individually configure 2FA in their personal user settings:

 

1.Navigate to your user settings.
 

 

2.Scan the provided QR code using a common authenticator app (e.g., Google Authenticator or Microsoft Authenticator).
 

 
Alternative: If scanning is not possible, you may copy the shared secret and enter it manually into the app.

 

 

3.For final activation, enter the six-digit One-Time Password (OTP) generated by the app into the web interface.

 

4.Following successful activation, a number of backup codes defined by the admin will be displayed. These serve as a security reserve to bypass or deactivate two-factor authentication if necessary.
 

 

 

3.Login Process with Two-Factor Authentication
Following the successful activation of Two-Factor Authentication, you must provide the One-Time Password (OTP) from your authenticator app during every login process. The process is structured in two stages: first, the username and password are entered and confirmed. Only then will the input field for the 2FA token appear, where the current code from the app is entered to complete the login.
 

 

4.Deactivating Two-Factor Authentication
To deactivate Two-Factor Authentication, navigate to your user settings again. Enter your current One-Time Password (OTP) from the authenticator app or one of your backup codes. By clicking the Deactivate Two-factor authentication button, the function will be disabled for your account.
 

 

5.Deactivating Two-Factor Authentication (admin)
The admin has the option to deactivate Two-Factor Authentication (2FA) for users directly via the web interface. To do this, navigate to System (local) in the menu. From there, click the button "User: Deactivate Two-factor authentication" to open the deactivation form.
 

In this form, the admin specifies which account's 2FA should be disabled. Both the domain and the username must be entered. If the domain field is left blank, the default domain will be used.
 

 
Once the deactivation is successful, the following confirmation will be displayed:
 

 

6.Administrative Settings
There are various settings available to modify Two-Factor Authentication. These settings can be configured in the Infoserver.ini. For further information regarding the Infoserver.ini, please refer to the Serverboard chapter.

 

 

 

Locking the Admin Account

 

You have the option to lock the admin account for a defined period after a specified number of failed login attempts. This measure significantly increases account security, as brute-force attacks are effectively prevented or hindered by the resulting time delay.

Configuration is managed via the following entries in the Infoserver.ini. Further information can be found in the Serverboard chapter.