Security settings

Where

Administration → Settings → Security. Saving is audited (security_policy_changed) and every replica applies it within 10 seconds. The defaults keep Janus as it was; Start from a baseline (NIST SP 800-63B, PCI DSS 4.0, FedRAMP Moderate or the DoD STIG) and Apply baseline fills in its values for you to review and save; only the STIG is enforced, by the STIG profile.

Sessions

Idle sign-out for people and for administrators, the longest session, and a limit of sessions per person (a new sign-in ends the oldest). JANUS_SESSION_IDLE_TIMEOUT_HOURS and JANUS_SESSION_TTL_HOURS remain upper bounds. Only what the person does counts as activity, not the app refreshing by itself; a minute before the limit the person is warned and can stay signed in.

Sign-in notice

When on, the notice is shown before every sign-in method and nothing is offered until the person acknowledges it; the server refuses a sign-in without a fresh acknowledgment. Use the DoD Notice and Consent text fills in the standard DoD banner. Editing the text makes people acknowledge again.

Lockout and passwords

After the set number of failures within the window, the sign-in name is locked for the set time, or until an administrator unlocks it under Locked now (0 minutes). It covers Janus passwords and directory sign-in. Password rules (length, character kinds, characters changed, history, minimum and maximum age) apply at the next change; an expired password must be changed at sign-in.

Audit log and forwarding

Sign-in, sign-out, failures, lockouts, time-outs and access-denied are part of the audit log, each with the source address and outcome. The Audit page filters by kind, outcome, address, action, person and time, searches, and sorts; the export follows the filters.

Audit forwarding sends every record to syslog or a SIEM over UDP, TCP or TLS, as RFC 5424 or CEF. TLS servers are verified against Settings → Certificates. Send a test event shows the exact error. Records wait in a queue and never slow a request; they always stay in Janus too.

Smart card (CAC/PIV)

Adds a Smart card button to the sign-in page. The certificate comes from Janus itself (listener TLS on; Janus asks for an optional client certificate) or from the proxy in front of Janus in a header (X-Forwarded-Client-Cert, escaped PEM or base64), accepted only from JANUS_TRUSTED_PROXIES.

The certificate must chain to an authority under Settings → Certificates (the DoD roots, a mounted bundle or an upload) and passes the revocation check. It is matched to a person by UPN, email or DoD ID number (EDIPI), in the order you choose; an administrator can also set a card identity on a person. Unknown cards are refused unless you allow creating accounts, and administrators can be required to use a card.