I'm going to build an experimental mail server with Postfix + Dovecot and Mysql for user accounts. The server will offer SMTP + POP3 + IMAP.
Is there a way to force users to change their mail account passwords every six months?
1
-
Note that mandatory frequent password changes are not a panacea, they often hurt security, Mail-only passwords are one of the few cases where they can be a good idea, but note that this is only really viable if the users have this password entered in a file on their client, not if you expect them to memorize it. Recommended reading: How does changing your password every 90 days increase security?– Gilles 'SO- stop being evil'Commented Aug 31, 2012 at 1:07
Add a comment
|
1 Answer
grep'ing through dovecot 2.1 source code it appears that they have a constant IMAP_RESP_CODE_EXPIRED used for the RFC 5530 "EXPIRED" code, which would be used to tell the client the password has expired. I see code to that notices expired accounts, and returns PASSDB_RESULT_PASS_EXPIRED from various different methods (but not the db-sql method).
Further, I don't see anywhere where the server sends that response.
This holds true in 2.2 as well, where a few more authentication methods gain PASSDB_RESULT_PASS_EXPIRED (but still not db-sql). And still nowhere I see the server sending it.
So, I'd guess that Dovecot currently doesn't support this, but they're (slowly?) working towards it.
I'm not even sure the IMAP protocol provides a way to change a password. I couldn't come up with one despite serious Google attempts.
(You could email people warning them their password is about to expire, and set up a web page for them to change it, but, well, I bet I have several of those in my spam box right now! Oddly enough, not actually sent by mail server's admin. In case the sarcasm doesn't carry, this is a relatively common phishing scheme.)
answered Aug 30, 2012 at 17:18
