Configuring 1C-Bitrix security policies

Security Policy Configuration for 1C-Bitrix

Security policies in Bitrix are not an abstract section of the documentation — they are specific parameters that directly affect how easy it is to compromise a user or administrator account. By default, many of them are set in a permissive mode — for development convenience, not for protection.

Password Policies

Configured in Settings → Password Policies. Each policy is assigned to user groups. Administrators and managers should have a separate policy with the strictest requirements.

Key parameters:

• Minimum length — at least 10 characters for staff, 12 for administrators
• Required character types — lowercase, uppercase, digits, special characters
• Password expiration — forced change after N days. For the "Administrators" group — 90 days
• Password history — prohibit reuse of the last N passwords (recommended: 5–10)
• Attempt limit — lockout after N failed attempts (b_user_auth_attempts)

Session and Authorization Settings

Settings → Main Module → Security:

• Session lifetime — by default matches session.gc_maxlifetime in PHP. For the admin panel, 30–60 minutes is recommended
• "Remember me" — disable or reduce the duration to 7–14 days. Long-lived cookies are an attack vector if a device is compromised
• Session binding to IP — enable BX_SECURITY_SESSION_VIRTUAL_DIRECTORY and IP verification. Caution: mobile users may have changing IPs

Admin Panel Protection

Restrict access to /bitrix/admin/ by IP — add to .htaccess or nginx configuration:

location /bitrix/admin/ {
    allow 192.168.1.0/24;
    allow 203.0.113.10;
    deny all;
}

Changing the admin panel URL via the "Proactive Defense" module (Security → Proactive Defense → Admin Panel Protection) — adds a secret prefix to the path.

Real-World Case

A corporate portal on Bitrix24 (on-premise). A user with manager permissions left a session open on their work computer and went on vacation. A colleague gained access to their account. Solution: configured a policy restricting inactive session time to 2 hours and requiring logout when the browser is closed (session.cookie_lifetime = 0).

Execution Timelines

Auditing current policies and configuring them to meet security requirements — 3–5 hours.