Authentication policy

Session lifetime, idle timeout, and login-failure lockout. Stored in /var/db/ogmaprotect/auth/auth.yaml and applied without a restart. A box with no policy uses the defaults (8 hour session, no idle timeout, 5 failures, 15 minute window); a box provisioned by this release starts with a 15 minute idle timeout (PCI DSS 8.2.8), and a box upgraded from an earlier release keeps whatever it had. The system refuses a policy that could lock administrators out (too-short session or too-aggressive lockout).

Refused (anti-lockout): {{FLOOR_HINT}}

Session lifetime (hours, 1–720)

Absolute lifetime of a sign-in session. The login cookie expires with it.

Idle timeout (minutes; 0 = disabled)

Sign out a session after this much inactivity. 0 disables the idle timeout (absolute lifetime only). When set, must be at least 5 minutes and not exceed the session lifetime; an open page then signs itself out after this long with no keyboard, mouse or touch input, in every tab.

Lockout threshold (failures, 3–1000)

Number of failed sign-ins (within the window below) that triggers a lockout. The minimum is 3 so a fat-fingered password cannot lock you out.

Lockout window (minutes, 1–1440)

Failed sign-ins are counted over this rolling window.

Lockout scope

What a lockout keys on. user_ip (recommended) resists both targeted-account guessing and single-source spraying without one source locking out a username globally.