3.3 Explain important concepts pertaining to identity and access management for server administration.

📘CompTIA Server+ (SK0-005)

Password policies are a critical part of identity and access management (IAM) in server administration. They define rules that control how passwords are created, used, and managed to protect systems from unauthorized access.

A strong password policy helps prevent:

Unauthorized logins
Brute-force attacks
Credential theft
Privilege escalation

This section focuses on three key components:

Length
Lockout
Enforcement

1. Password Length

What is Password Length?

Password length refers to the minimum and maximum number of characters a password must contain.

Why It Matters

Longer passwords are harder to guess or crack.
Short passwords can be easily broken using automated tools.

Key Concepts

Minimum length: The smallest number of characters required.
Maximum length: The allowed upper limit (varies by system).
Modern systems prefer longer passwords over complex short ones.

Recommended Practices

Minimum length: 8–12 characters (minimum)
Stronger security: 14+ characters
Encourage use of:
- Uppercase letters (A–Z)
- Lowercase letters (a–z)
- Numbers (0–9)
- Special characters (!, @, #, etc.)

Example in IT Environment

In a Windows Server domain, administrators configure password length using Group Policy.
Example:
- Minimum password length = 12 characters
Users cannot create passwords shorter than this requirement.

2. Account Lockout Policies

What is Account Lockout?

Account lockout policies define what happens when a user enters the wrong password multiple times.

Why It Matters

Protects against brute-force attacks (automated password guessing).
Prevents attackers from trying unlimited login attempts.

Key Components of Lockout Policy

1. Lockout Threshold

The number of failed login attempts allowed before the account is locked.
Example:
- 5 failed attempts → account is locked

2. Lockout Duration

How long the account remains locked.
Example:
- 15 minutes lockout

3. Reset Counter Time

Time after which failed attempts are reset to zero.
Example:
- If no failed attempts occur for 10 minutes, the counter resets

Example in IT Environment

A user attempts to log into a server:
- Enters wrong password 5 times
- Account is locked automatically
The user must:
- Wait for lockout duration OR
- Contact an administrator to unlock the account

Important Considerations

Too strict → users get locked out frequently (affects productivity)
Too lenient → increases security risk

A balance must be maintained.

3. Password Policy Enforcement

What is Enforcement?

Enforcement ensures that all users follow the defined password rules.

It is implemented through:

System settings
Security policies
Directory services (like Active Directory)

Key Enforcement Settings

1. Password Complexity Requirements

Forces users to create strong passwords by requiring:

Uppercase and lowercase letters
Numbers
Special characters
No use of username or simple words

2. Password History

Prevents reuse of old passwords
Example:
- System remembers last 10 passwords
- User cannot reuse them

3. Maximum Password Age

Defines how long a password can be used
Example:
- 90 days → user must change password after 90 days

4. Minimum Password Age

Prevents users from changing passwords too quickly to bypass history
Example:
- Must wait 1 day before changing again

5. Account Restrictions

Applies password rules to:
- User accounts
- Service accounts (with special considerations)
Service accounts may require:
- Longer passwords
- Controlled or non-expiring passwords (depending on environment)

Example in IT Environment

In an enterprise server environment:

Administrator configures policies in Active Directory Group Policy
All domain users must:
- Use at least 12-character passwords
- Include complexity
- Change passwords every 60 days
System automatically enforces rules during password creation

Best Practices for Exam and Real-World

Strong Password Policy Should Include:

Minimum length of 12+ characters
Account lockout after 3–5 failed attempts
Lockout duration of 15–30 minutes
Password history of at least 10 previous passwords
Regular password expiration (e.g., 60–90 days)
Complexity requirements enabled

Common Exam Points to Remember

Length is more important than complexity alone
Lockout policies prevent brute-force attacks
Enforcement ensures compliance with security rules
Password policies are typically configured via:
- Group Policy (Windows)
- PAM or configuration files (Linux)

Summary

Password policies are essential for securing server environments. They:

Define how passwords must be created (length)
Protect accounts from repeated attacks (lockout)
Ensure rules are followed consistently (enforcement)