I'm going to build an experimental mail server with Postfix + Dovecot and Mysql for user accounts. The server will offer SMTP + POP3 + IMAP.
Is there a way to force users to change their mail account passwords every six months?
grep'ing through dovecot 2.1 source code it appears that they have a constant
Further, I don't see anywhere where the server sends that response.
This holds true in 2.2 as well, where a few more authentication methods gain PASSDB_RESULT_PASS_EXPIRED (but still not db-sql). And still nowhere I see the server sending it.
So, I'd guess that Dovecot currently doesn't support this, but they're (slowly?) working towards it.
I'm not even sure the IMAP protocol provides a way to change a password. I couldn't come up with one despite serious Google attempts.
(You could email people warning them their password is about to expire, and set up a web page for them to change it, but, well, I bet I have several of those in my spam box right now! Oddly enough, not actually sent by mail server's admin. In case the sarcasm doesn't carry, this is a relatively common phishing scheme.)