Password Management and Account Recovery

Understanding Server Scout's Password Security

Server Scout takes a comprehensive approach to password security, implementing multiple layers of protection to keep your monitoring data safe. This guide covers the essential aspects of password management and account recovery features built into the platform.

Self-Service Password Recovery

Server Scout provides a straightforward password reset process that balances security with usability.

The Forgot Password Flow

1. Navigate to the Server Scout login page and click "Forgot Password"
2. Enter your registered email address and submit the form
3. Check your email for a password reset message (including spam folders)
4. Click the secure link in the email to access the reset form
5. Enter your new password following the security requirements
6. Complete the reset and log in with your new credentials

Important security note: Reset tokens are valid for exactly one hour after generation. This time limit reduces the risk of unauthorised access if an email account becomes compromised. If your token expires, simply request a new reset email.

Administrative Password Management

System administrators have additional tools for managing user accounts when self-service recovery isn't suitable.

Admin Password Reset Function

Administrators can generate temporary passwords for users through the admin interface:

1. Access the user management section of your Server Scout dashboard
2. Locate the affected user account
3. Select the "Reset Password" action
4. The system generates a secure temporary password
5. Share this temporary password with the user through a secure channel
6. Instruct the user to change the password immediately upon first login

This feature is particularly useful for onboarding new team members or assisting users who no longer have access to their registered email addresses.

Password Requirements and Best Practices

Server Scout enforces strong password standards to protect against common attack vectors:

• Minimum 8 characters in length
• Must include a combination of uppercase and lowercase letters
• Require at least one numeric digit
• Must contain at least one special character
• Cannot reuse the last 5 passwords
• Cannot contain common dictionary words or patterns

Recommended Password Strategies

Use a Password Manager: We strongly recommend using a dedicated password manager such as Bitwarden, 1Password, or KeePass. These tools can generate unique, complex passwords for each service whilst keeping them easily accessible.

Unique Passwords Only: Never reuse your Server Scout password for other services. If one account becomes compromised, unique passwords prevent cascade failures across your other systems.

Regular Updates: Consider updating passwords quarterly, especially for administrative accounts with elevated privileges.

Brute Force Protection

Server Scout implements several mechanisms to protect against automated password attacks:

• Rate Limiting: Failed login attempts trigger progressive delays
• Account Lockouts: Multiple failed attempts temporarily disable accounts
• IP-based Restrictions: Suspicious IP addresses face additional scrutiny
• Monitoring and Alerts: Unusual login patterns generate security notifications

These protections operate automatically, requiring no configuration from administrators.

Session Security Management

Server Scout employs robust session management practices to maintain security after successful authentication:

Cookie Security

All authentication cookies use the HttpOnly flag, preventing client-side JavaScript from accessing session tokens. This protects against cross-site scripting (XSS) attacks that might attempt to steal authentication credentials.

Automatic Session Expiry

Sessions expire automatically based on:

• Idle Timeout: Sessions end after 30 minutes of inactivity
• Absolute Timeout: All sessions expire after 8 hours regardless of activity
• Browser Closure: Sessions don't persist beyond browser sessions

Maintaining Account Security

Regular security hygiene helps maintain the integrity of your Server Scout deployment:

• Review user accounts monthly and remove unused accounts
• Monitor login logs for suspicious activity
• Ensure all users understand password requirements
• Implement organisation-wide password policies that complement Server Scout's built-in protections
• Consider enabling two-factor authentication if your organisation requires additional security layers

By following these practices and utilising Server Scout's built-in security features, you can maintain a secure monitoring environment whilst ensuring legitimate users retain convenient access to critical server data.