I'm going to build an experimental mail server with Postfix + Dovecot and Mysql for user accounts. The server will offer SMTP + POP3 + IMAP.
Is there a way to force users to change their mail account passwords every six months?
grep'ing through dovecot 2.1 source code it appears that they have a constant
IMAP_RESP_CODE_EXPIRED used for the RFC 5530 "EXPIRED" code, which would be used to tell the client the password has expired. I see code to that notices expired accounts, and returns PASSDB_RESULT_PASS_EXPIRED from various different methods (but not the db-sql method).
Further, I don't see anywhere where the server sends that response.
This holds true in 2.2 as well, where a few more authentication methods gain PASSDB_RESULT_PASS_EXPIRED (but still not db-sql). And still nowhere I see the server sending it.
So, I'd guess that Dovecot currently doesn't support this, but they're (slowly?) working towards it.
I'm not even sure the IMAP protocol provides a way to change a password. I couldn't come up with one despite serious Google attempts.
(You could email people warning them their password is about to expire, and set up a web page for them to change it, but, well, I bet I have several of those in my spam box right now! Oddly enough, not actually sent by mail server's admin. In case the sarcasm doesn't carry, this is a relatively common phishing scheme.)