Protect Your Applications with a Strong Password
Strong, unique passwords help protect your Ultra applications and accounts from password guessing, credential stuffing, and unauthorized access. This guide explains how to create and manage secure passwords, enable Two-Factor Authentication for your User Control Panel, and further secure SSH access.
Create a Strong Password
One of the most important aspects of a strong password is its length. However, length alone does not make a predictable or previously exposed password secure. Each password should be long, random, and unique.
Password-cracking estimates are illustrative. Actual cracking times depend on factors such as the password’s randomness, the hashing algorithm, and the attacker’s hardware. See the current Hive Systems Password Table for its latest methodology and estimates.
Follow these recommendations:
- Use a password manager to generate a unique, random password.
- Aim for at least 16 characters when the application supports it. Longer passwords are generally harder to guess.
- If you must create a memorable password, use a long passphrase made from several randomly selected, unrelated words.
- Use a different password for every application and account.
- Do not reuse your User Control Panel, Client Area, email, SSH/FTP, or HTTP access password for an application.
- Do not include your name, username, email address, application name, server name, birthdays, pet names, or other information that someone could discover.
- Avoid common passwords, keyboard patterns, and predictable substitutions such as
password,qwerty,123456, orP@ssw0rd. - Do not create a new password by adding a number or symbol to an old password.
- Change a password immediately if you believe it has been exposed or used by someone else.
- Change the password on every other account where you reused it.
A mixture of uppercase letters, lowercase letters, numbers, and symbols can strengthen a randomly generated password. However, length, randomness, and uniqueness are more important than satisfying a predictable character pattern.
Use a Password Manager
A password manager can generate and securely store a different password for each account. This removes the need to remember or manually modify multiple passwords.
The following password managers are available:
- Bitwarden is an open-source password manager.
- KeePass is a free, open-source password manager that stores an encrypted password database.
- LessPass is an open-source, stateless password manager.
You may also use a reputable password manager built into your browser or device. Follow these precautions:
- Keep your browser, operating system, and device updated.
- Protect your device with a password, PIN, or biometric lock.
- Do not save passwords in a shared browser profile.
- Do not save passwords on a public or untrusted device.
- Protect your password manager with a strong, unique primary password.
- Enable Two-Factor Authentication for your password manager when available.
Enable Two-Factor Authentication
Two-Factor Authentication adds another verification step to your User Control Panel account. Someone who obtains your UCP password would also need the code generated by your authenticator app.
To enable it:
- Sign in to the User Control Panel.
- Open Profile.
- Click Set Up Two-Factor Authentication.
- Scan the QR code with your authenticator app, or enter the setup key manually.
- Enter the generated six-digit code to confirm the setup.
- Save the provided backup codes in a secure location.
- Store the backup codes separately from your UCP password.
- Trust a device for 30 days only if it is your private, secured device.
Change an Application Password
You can manage supported application passwords through the UCP.
- Sign in to the User Control Panel.
- Open the applicable Ultra service.
- Open Apps.
- Find the application and click Actions.
- Select the password-change action when it is available.
- Generate a new, unique password with your password manager.
- Save the change.
- Update the corresponding entry in your password manager.
- Sign in to the application with the new password to confirm that it works.
Available actions vary by application. Some applications may require you to change the password from the application’s web interface.
Connection passwords, including supported SSH/FTP and HTTP credentials, are managed separately from the Connect section of your service.
Use SSH Key Authentication
Where possible, use SSH key authentication instead of relying only on an SSH password. Protect the private key with a strong, unique passphrase.
See Public Key Authentication for instructions on generating an SSH key pair, adding the public key to your Ultra service, and connecting with key authentication.
Respond to a Compromised Password
Take immediate action if you believe that someone has obtained one of your passwords.
- Change the affected password.
- Change it on every other account where you reused it.
- Review the application and UCP for unexpected changes.
- Enable Two-Factor Authentication on your UCP account.
- Secure the associated email account because it may receive password-reset links.
- Sign out of unknown or untrusted sessions when the application provides that option.
- Open a support ticket if you need assistance.
By using long, random, and unique passwords together with a password manager, Two-Factor Authentication, and SSH keys, you can significantly reduce the risk of unauthorized access to your Ultra applications and accounts.
If you require further assistance, you can open a support ticket here.