Security

Security Settings

Into the Security panel, you fins some general settings related to the security of the system.

Password rules

You may define a set of rules to enforce a minimum quality of the password for the users. Use the Generate button to generate a sample password compliant with all the configured rules.

Size: The character size of the password (represents the minimum character size of the password)

Upper case chars: Minimum number of uppercase characters

Lower case chars: Minimum number of lowercase characters

Max occurrences: Maximum number of occurrences of the same character

Enforce password history: Prevents the reuse of a password already used N times before

Digit chars: Minimum number of digits

Special chars: Minimum number of special characters

Max sequence size: Maximum number of sequences (these are sequences of characters of the same type, e.g., 1234, abcd, GHIJK)
If the sequence is longer than the maximum number, it prevents the password from being set.
The comparison operator is <=, so the number of sequences must be <= the set number.
E.g., with 4, the sequence 56789 is not accepted, while 56689 is.
The same applies to the sequence GHIJK, while GHIJT is accepted.
Note: This parameter is case-insensitive.

Password expiration: duration of the password before being asked to change it

Enforce password history: number of old passwords remembered by the system for each user in order to prevent their re-usage

Other security settings

Max. inactivity: If a user does not have any interaction with the system within this number of days, it will be automatically disabled.

Save Login: if the users have the option to store their credentials in the browser

Alert login from new device: Alerts the user when logging in from a device not yet encountered

Ignore login case: if LogicalDOC must ignore the case of the username to authenticate the users

Allow sid in request: permits the sid attribute in the request in order to pass the session identifier. Activate this option only if really needed because it may compromise the security.

Cookies SameSite: determines when cookies are included in requests

Use secure cookies: enables the cookies only when using the HTTPS protocol

Force SSL: if active, LogicalDOC will redirect all HTTP requests to the HTTPS secure protocol (read this how-to for installing your Certificate)

Content Security Policy: the content to put in the HTTP response header Content-Security-Policy.

Check at login: checks the password compliance at login and if it does not comply, the user gets forced to change it.

Anonymous

By activating this option, you can grant access to the system by anonymous users without passing through the login page and the normal authorization chain.

When the option is enabled you can distribute the special URL as shown above, to people not registered in the system. Anyone accesses to that URL will be automatic logged in as he was the user selected in the User parameter.

The anonymous visitor can do inside the repository whatever thing that the assigned User can do on the basis of the security policies that you granted him. Please note that part of the anonymous URL is regulated by the Key parameter, so change it in case you need to invalidate already distributed URLs.

Use with care

Please enable this option just in cases where you really need it, and make sure to assign a user with limited access to your repository

Menus

In this panel, you can determine which entities (users and groups) can access a menu. After selecting a menu item, to add new security entities use Add Group and Add User list boxes, to drop an element right-click on the name and press Delete. If you want to make your changes persistent, you have to press the Apply Rights button.

Geolocation

LogicalDOC is able to geolocalize all the incoming requests, and this gives you the opportunity to track where your users are coming from. We use the GeoLite database, so you have to input your MaxMind License Key. You get your free license key by subscribing to GeoLite2 here: https://www.maxmind.com/en/geolite2/signup

It is important to maintain updated the GeoLite database, so from time to time click on Sync Geolocation Database

Precision

The geolocalization is possible only when the request comes from a public IP and in any case the precision totally relies on the used GeoLite database, so it is important to maintain it as updated as possible.

Antivirus

LogicalDOC can check if a submitted document is infected. It works with an Open Source antivirus software called ClamAV. This gives you full control over your documents base and will assure you to avoid the distribution of infected files through your document management system.

Enabled: If enabled, each new file will be inspected at upload time

ClamAV: Put here the path to the clamscan command in your system

Include: All files that match one of these inclusion filters will be checked

Exlude: All files that match one of these inclusion filters will not be checked

Timeout: Maximum time to check a file, 0 means no timeout at all

Firewall

You can access and edit the Firewall preferences by going to Administration > Security > Firewall

The Firewall allows administrators to restrict or allow access to the system based on:

IP addresses
Hostnames
Network ranges (CIDR notation)

When enabled, the firewall filters incoming requests before login, meaning blocked users cannot authenticate

Here you can optionally define a set of IPs, hostnames, or networks that are allowed or denied accessing the system.

CIDR - Classless Inter-Domain Routing - Notation (Network Ranges)

Instead of listing many IPs, you can define a range.

CIDR (Classless Inter-Domain Routing) is a way to define a range of IP addresses using a compact format. An address is written as:

IP_address/prefix

The IP address identifies the network
The prefix defines how large the range is

Example:

192.168.1.0/24

This means:

All IPs from 192.168.1.0 to 192.168.1.255

Be careful when using large ranges, as they may unintentionally allow or block many users.
Even if a user’s IP is not explicitly listed, it may still be blocked if it falls inside a CIDR range defined in the blacklist.

URL Security Options

These toggles control whether certain characters are allowed in HTTP requests.
They are security-related and should only be enabled if necessary.

Brute Force Attack Prevention

In this panel, you can fine tune your strategy to protect the system from brute force attacks.

If a maximum number of login failures is detected for the same username, that username gets blocked for a given amount of minutes.

If a maximum number of login failures is detected from the same IP, that address gets blocked for a given amount of minutes.

In the panel, it is also available list of currently blocked usernames and/or IPs.

Access Control

Instead of assigning access rights to each user individually(that in any case is also supported), we suggest administrators to assign permissions to groups, what in other systems you may see as "roles".

Role-Based Access Control (RBAC)

Role-Based Access Control works by assigning permissions to roles (like admin, author, or guest) rather than to individual users. Employees are then placed into these roles, automatically inheriting the exact access rights needed for their specific job functions. To understand how RBAC works, you can break it down into these core components.

Permissions

Specific actions allowed on a resource like a folder or a document, such as read, write, edit.

Complete list of Permissions


Permission	Applicable Resources	Actions Allowed on Resources
Read	all	accessing and using
Preview	document	displaying in the interface
Print	document	printing
Download	document, folder	extracting from the platform
Email	document	including the resource in an email
Write	all	editing
Add	folder	adding new elements inside
Security	document, folder	managing security policies
Immutable	document	enabling immutability
Password	document	protecting with a password
Delete	all	logically removing
Move	document, folder	moving into another location
Rename	document, folder	modifying the name
Custom ID	document	editing the Custom ID
Revision	document	editing the Revision
Import	folder	importing from .zip archives or other source
Export	folder	exporting to .zip archive or other target
Sign	document	digitally signing
Archive	document, folder	archiving or inserting into an export archive
Workflow	document	launchin a new workflow instance
Calendar	document	creating a calendar event
Subscription	document, folder	subscribing other users to the issued alerts
Automation	document, folder	invoking an automation routine
Reading request	document	sending a reading request
Store	folder	changing the default store

Admins can do everything

The users in the admin group always have full permissions on all the resources.

Everywhere you have an object sensible of security policies like folders or documents, you can grant permissions to groups.

Groups (roles)

Collections of permissions created to match specific job responsibilities (e.g., an "Accountant" role has permission to read invoices and create payrolls).

More details about Groups

Users

The system accounts assigned to the groups. A user may be assigned to one or more groups.

More details about Users

Scalability and Security

The main advantage of this model is scale and security. When an employee is hired or changes departments, you simply assign them a new role. If a permission changes (for example, allowing a manager to approve software purchases), you just update the manager role, and everyone with that role gets the new access instantly.