0

I'm going to build an experimental mail server with Postfix + Dovecot and Mysql for user accounts. The server will offer SMTP + POP3 + IMAP.

Is there a way to force users to change their mail account passwords every six months?

  • Note that mandatory frequent password changes are not a panacea, they often hurt security, Mail-only passwords are one of the few cases where they can be a good idea, but note that this is only really viable if the users have this password entered in a file on their client, not if you expect them to memorize it. Recommended reading: How does changing your password every 90 days increase security? – Gilles Aug 31 '12 at 1:07
2

grep'ing through dovecot 2.1 source code it appears that they have a constant IMAP_RESP_CODE_EXPIRED used for the RFC 5530 "EXPIRED" code, which would be used to tell the client the password has expired. I see code to that notices expired accounts, and returns PASSDB_RESULT_PASS_EXPIRED from various different methods (but not the db-sql method).

Further, I don't see anywhere where the server sends that response.

This holds true in 2.2 as well, where a few more authentication methods gain PASSDB_RESULT_PASS_EXPIRED (but still not db-sql). And still nowhere I see the server sending it.

So, I'd guess that Dovecot currently doesn't support this, but they're (slowly?) working towards it.

I'm not even sure the IMAP protocol provides a way to change a password. I couldn't come up with one despite serious Google attempts.

(You could email people warning them their password is about to expire, and set up a web page for them to change it, but, well, I bet I have several of those in my spam box right now! Oddly enough, not actually sent by mail server's admin. In case the sarcasm doesn't carry, this is a relatively common phishing scheme.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.