Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 0 down vote favorite

I'm going to build an experimental mail server with Postfix + Dovecot and Mysql for user accounts. The server will offer SMTP + POP3 + IMAP.

Is there a way to force users to change their mail account passwords every six months?

share|improve this question
Note that mandatory frequent password changes are not a panacea, they often hurt security, Mail-only passwords are one of the few cases where they can be a good idea, but note that this is only really viable if the users have this password entered in a file on their client, not if you expect them to memorize it. Recommended reading: How does changing your password every 90 days increase security? – Gilles Aug 31 '12 at 1:07
Thank you Gilles for the advice! – PsyStyle Aug 31 '12 at 7:08

1 Answer

up vote 2 down vote accepted

grep'ing through dovecot 2.1 source code it appears that they have a constant IMAP_RESP_CODE_EXPIRED used for the RFC 5530 "EXPIRED" code, which would be used to tell the client the password has expired. I see code to that notices expired accounts, and returns PASSDB_RESULT_PASS_EXPIRED from various different methods (but not the db-sql method).

Further, I don't see anywhere where the server sends that response.

This holds true in 2.2 as well, where a few more authentication methods gain PASSDB_RESULT_PASS_EXPIRED (but still not db-sql). And still nowhere I see the server sending it.

So, I'd guess that Dovecot currently doesn't support this, but they're (slowly?) working towards it.

I'm not even sure the IMAP protocol provides a way to change a password. I couldn't come up with one despite serious Google attempts.

(You could email people warning them their password is about to expire, and set up a web page for them to change it, but, well, I bet I have several of those in my spam box right now! Oddly enough, not actually sent by mail server's admin. In case the sarcasm doesn't carry, this is a relatively common phishing scheme.)

share|improve this answer
Thank you derobert! I will investigate your answer! – PsyStyle Aug 31 '12 at 7:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.