Login and Account Security Options
Yurbi includes a set of security features for sign-in and user accounts. On a self-hosted server all of them are off by default: upgrading does not change how your users sign in until you turn a feature on.
This article is the starting point. Each feature has its own article with setup steps, what users see, and troubleshooting.
Features at a glance
Feature | What it does | Default (self-hosted) | Where | Needs |
|---|---|---|---|---|
Minimum length, common-password and breach screening for new passwords | Off | Settings → Server Settings → Security Settings | Internet access for the breach check | |
Blocks sign-in for 5 minutes after 5 wrong passwords | Off | Settings → Server Settings → Security Settings | — | |
Users reset their own password or sign in with an emailed link | Off | Settings → Server Settings → Security Settings | Outgoing email (SMTP), Public URL | |
Second step at sign-in: authenticator app, email code, text message or Duo | Off | Settings → Server Settings → Security Settings | Email for email codes; a text-message provider for SMS | |
Invite by email, disable, unlock, force a password change, reset 2FA | Always available | Settings → Security → Users | Email for invite and reset links | |
Mark accounts used by integrations, embedding or Server Sync so 2FA and forced password changes never interrupt them | Always available | User editor | — |
Recommended order
Confirm outgoing email works (Settings → Scheduler → Mail Settings) and set Public URL in Security Settings. Most features send email.
Turn on Allow users to reset a forgotten password by email. This removes most "I forgot my password" tickets.
Turn on Enforce password security and Lock account for 5 minutes after 5 failed sign-in attempts if your policy requires them.
Mark any integration, embedding or Server Sync accounts as service accounts before you touch two-factor settings.
Set Two-factor mode to Optional, switch on at least one method (Authenticator app is the simplest), enroll a few administrators, then switch to Required when ready.
Who these apply to
These features apply to users who sign in with a Yurbi username and password. Users who sign in through single sign-on (SSO), Windows authentication, or an external identity provider are authenticated by that system and are not affected by password reset, lockout, or two-factor settings. Service accounts sign in with a password but skip the two-factor and forced-password-change steps.
Audit trail
Every action in these features is recorded in Settings → Audit Log: password resets and changes, link sign-ins, lockouts and unlocks, disables, two-factor enrollments, challenges and verifications, backup-code use, remembered devices, administrator resets, and service-account changes.