Overview

Site Configuration allows administrators to manage system-wide settings for OneDB. These settings control authentication and MFA requirements, password security, traffic protection, diagnostic logging, time zone behavior, and other platform-wide operational controls.

Most settings can be updated at any time and take effect without requiring a system restart.

Password Settings

The Password Settings section is used to define password policy requirements for OneDB user accounts.

Administrators can configure password complexity rules to help improve account security and reduce the risk of weak passwords.

Password Complexity Options

The following password complexity options may be enabled:

Minimum Password Length

The Minimum Password Length field defines the minimum required password length for user accounts.

Example:

8

If the minimum password length is set to 8, users must create passwords with at least 8 characters.

Recommended password policy example:

Traffic Protection Settings

Traffic Protection Settings control how OneDB handles large SQL statements, slow database connections, and temporary traffic spikes.

These settings help balance security, performance, and system stability. In most environments, the default values are recommended.

Max SQL Inspection Size

Defines the maximum SQL size that OneDB will inspect before applying security and protection rules.

If a SQL statement exceeds this limit, OneDB follows the action configured in Large or Unsupported SQL Action.

Large or Unsupported SQL Action

Determines how OneDB handles SQL that exceeds the inspection limit or cannot be safely analyzed.

Available options:

For security-focused deployments, Block is recommended.

Database Connect Timeout

Specifies how long OneDB waits for a database connection before terminating the request.

Increasing this value may be helpful when databases are located across slower networks.

Advanced Safety Limits

Advanced Safety Limits provide additional protection against unusually large requests and temporary traffic surges.

These settings are intended for advanced environments and normally do not require modification.

Temporary Traffic Limit

Defines the maximum amount of client traffic OneDB can temporarily buffer while waiting for a database connection.

Temporary Message Limit

Defines the maximum number of client messages that can be held temporarily before OneDB begins slowing down or timing out requests.

Max Batch Check Size

Defines the largest batch operation OneDB will inspect before applying protection rules.

Max Batch Parts

Defines the maximum number of batch segments OneDB can temporarily hold while preparing SQL for inspection.

Max SQL Rebuild Size

Defines the largest SQL statement OneDB can reconstruct when SQL traffic arrives in multiple network packets.

This allows OneDB to inspect fragmented SQL statements before they are forwarded to the database.

Best Practices

• Use the default values unless a specific operational requirement exists.
• Configure Large or Unsupported SQL Action to Block for security-focused deployments.
• Increase limits only after evaluating memory and performance requirements.
• Monitor audit logs regularly for SQL statements that exceed inspection limits.
• Review advanced settings carefully before making changes in production environments.

Pagination Settings

The Pagination Settings section controls how many records are displayed in list or table views within the OneDB Admin Console.

This helps administrators manage screen readability and performance when viewing large datasets.

Pagination Setting Fields

Limit Per Page

The Limit Per Page setting determines how many records are shown on each page.

Example:

20

If the value is set to 20, OneDB displays up to 20 records per page in supported list views.

This setting may affect pages such as:

• User list
• Group list
• API user list
• Connection list
• Template list
• Audit trail list
• Database browser list

Max Characters Per Field

The Max Characters Per Field setting determines how many characters are displayed for each field or column.

Example:

50

If a field value is longer than the configured limit, OneDB may shorten or truncate the displayed value in the interface.

This is useful for improving readability when displaying long values such as:

• URLs
• Tokens
• Long text fields
• Request details
• Log details
• Database field values

This setting affects display behavior only. It does not change the actual value stored in the database.

Password Settings

The Password Settings section is used to define password policy requirements for OneDB user accounts.

Administrators can configure password complexity rules to help improve account security and reduce the risk of weak passwords.

Password Complexity Options

The following password complexity options may be enabled:

Minimum Password Length

The Minimum Password Length field defines the minimum required password length for user accounts.

Example:

8

If the minimum password length is set to 8, users must create passwords with at least 8 characters.

Recommended password policy example:

Multi-Factor Authentication

The Authentication Security / Multi-Factor Authentication section allows administrators to define how Multi-Factor Authentication (MFA) is applied to OneDB Admin Console users.

MFA adds a time-based one-time password (TOTP) verification step after the user enters their username and password. This provides an additional layer of protection against unauthorized access.

OneDB MFA supports standard TOTP-compatible authenticator applications, including:

• Google Authenticator
• Microsoft Authenticator
• Authy
• 1Password

TOTP does not require internet access after enrollment. It can be used in isolated or air-gapped environments, provided that the OneDB server and authenticator device have accurate time.

Accurate time synchronization is important for MFA. Configure NTP or ensure the OneDB appliance time is correct before enabling MFA enforcement.

MFA Policy

The MFA Policy setting determines which OneDB users are required or allowed to enroll in MFA.

Recommended MFA Policy

For most production deployments, use:

Disabling MFA should be treated as a temporary exception. Re-enable the required MFA policy after troubleshooting or emergency recovery is complete.

MFA Enrollment Enforcement

The MFA Enrollment Enforcement setting controls what happens when a user is subject to a mandatory MFA policy but has not completed MFA enrollment.

This setting applies only when the MFA Policy is configured as:

• Required for administrators, or
• Required for all users

When MFA Policy is set to Disabled or Optional for users, MFA Enrollment Enforcement has no effect.

Enforce Immediately

Use Enforce immediately when MFA must be active before protected administrative access is allowed.

When a user who is covered by the MFA policy signs in without completing MFA enrollment:

1. The user signs in using their username and password.
2. OneDB directs the user to MFA enrollment.
3. The user scans the QR code using a supported authenticator application.
4. The user enters the generated verification code.
5. MFA enrollment is completed.
6. The user can continue to the OneDB Admin Console.

This option is recommended for production environments where administrator access must be protected immediately.

Reminder Only

Use Reminder only when MFA is being introduced gradually.

Users who have not yet enrolled receive an MFA reminder after login, but they can postpone enrollment and continue using OneDB.

This option is useful when:

• Rolling out MFA to an existing user base.
• Giving users time to install an authenticator application.
• Coordinating MFA enrollment with administrators in multiple locations.
• Preparing a transition from optional MFA to mandatory MFA.

Reminder only should normally be used as a temporary rollout stage. After users have enrolled, change MFA Enrollment Enforcement to Enforce immediately.

Recommended MFA Rollout

A phased rollout helps reduce disruption for existing users.

MFA Administration Notes

• MFA policy changes affect OneDB Admin Console authentication only.
• MFA enrollment is individual to each user account.
• Each user should register their own authenticator application.
• MFA reset is available from the User Edit page for authorized administrators.
• Resetting MFA removes the user’s existing enrollment but does not change their password, group, email address, or account permissions.
• When a user loses a phone or authenticator device, verify their identity before resetting MFA.
• Review user MFA status regularly, especially after enabling a mandatory MFA policy.

How to Configure MFA

1. Open Settings from the OneDB navigation menu.
2. Select Site Configurations.
3. Locate the Authentication Security / Multi-Factor Authentication section.
4. Select the required MFA Policy.
5. When using a mandatory MFA policy, select the required MFA Enrollment Enforcement behavior.
6. Save the Site Configuration changes if required by the interface.
7. Inform affected users about the MFA policy and enrollment requirement.

Tested Authenticator Applications

OneDB MFA uses Time-Based One-Time Password (TOTP) authentication.

The following authenticator applications have been tested and are currently working with OneDB:

Other TOTP-compatible authenticator applications may also work, but should be validated in the organization’s environment before production use.

TOTP code validation does not require internet access after enrollment. It can be used in air-gapped environments, provided the OneDB server and authenticator device maintain accurate time.

Time Zone Configuration

The Time Zone Configuration section is used to define the application time zone for OneDB.

This setting affects how timestamps are displayed across the OneDB Admin Console.

Application Time Zone

The Application Time Zone field defines the time zone used by the OneDB interface.

Example:

Asia/Jakarta

This setting may affect timestamp display in areas such as:

• Audit Trail
• Monitoring
• Syslog Setting
• Backup/Restore history
• Configuration update timestamps
• Other time-based records in the Admin Console

Recommended Practice

Set the application time zone based on the organization’s operational location or primary administrator location.

For example:

For environments managed by regional or global teams, the selected time zone should be agreed internally to avoid confusion when reviewing audit records, logs, or operational events.

Important Notes

• Site Configuration settings affect the behavior and display of the OneDB Admin Console.
• Pagination and maximum character settings are intended to improve readability and usability when viewing records in the interface.
• The Max Characters Per Field setting controls displayed characters only and does not modify the actual stored value.
• Password complexity settings help enforce stronger password requirements for OneDB users.
• Changes to password policy may affect new password creation or password update activities, depending on the OneDB version and implementation.
• The application time zone affects how timestamps are displayed in the Admin Console. It does not necessarily change the underlying system time or database server time.
• Administrators should align the application time zone with the organization’s operational and audit review requirements.
• MFA enforcement depends on the selected MFA Policy.
• Required for administrators applies to users with administrator-level access through their assigned group.
• Required for all users applies to all OneDB Admin Console user accounts.
• Enrollment enforcement does not apply when MFA is disabled or optional.
• TOTP verification depends on time accuracy. Incorrect server or device time may cause valid MFA codes to be rejected.
• MFA is particularly important for administrator accounts because those accounts can manage users, policies, connections, listeners, and security configuration.
• OneDB MFA currently uses TOTP and has been tested with Google Authenticator, Microsoft Authenticator, Authy, and 1Password.

Recommended Practice