iRedMail
// Document IndexAttention
Check out the lightweight on-premises email archiving software developed by iRedMail team: Spider Email Archiver.
Roundcube webmail and SOGo groupware are configured to store password change date while user changed password.
vmail,
column mailbox.passwordlastchange. If user didn't change password before,
the password last change date will be set to 0000-00-00 00:00:00.shadowLastChange of user
account. If user didn't change password before, this attribute is absent.iRedAPD has plugin to force mail users to change password before sending email:
sql_force_change_password: for SQL backends (MySQL, MariaDB and
PostgreSQL).ldap_force_change_password: for LDAP backends (OpenLDAP and OpenBSD
built-in LDAP server ldapd(8)).When user trying to send an email, iRedAPD invokes this plugin to check
password last change date stored in SQL/LDAP and compare it with current time,
if it's longer than defined days (parameter CHANGE_PASSWORD_DAYS), this
plugin rejects the smtp session with defined message (parameter
CHANGE_PASSWORD_MESSAGE).
To enable this plugin, please list the plugin name in iRedAPD config file
/opt/iredapd/settings.py, variable plugins =. For example:
# For SQL backends
plugins = [..., 'sql_force_change_password']
# For LDAP backends:
plugins = [..., 'ldap_force_change_password']
There're three optional settings pre-defined in /opt/iredapd/libs/default_settings.py,
if you want to change them, please copy the parameter names and set proper values
in /opt/iredapd/settings.py:
# Force to change password in certain days.
CHANGE_PASSWORD_DAYS = 90
# Reject reason.
# It's recommended to add URL of the web applications which user can login
# to change password in this message. e.g. Roundcube webmail, iRedAdmin-Pro.
CHANGE_PASSWORD_MESSAGE = 'Password expired or never changed, please change your password in webmail before sending email'
# Allow certain users or domains to never change password.
# sample values: ['user@example.com', 'domain.com']
CHANGE_PASSWORD_NEVER_EXPIRE_USERS = []
Restarting iredapd service is required after changed /opt/iredapd/settings.py.
force_password_changeThere's a third-party Roundcube plugin can force user to change password. https://bitbucket.org/wainlake/force_password_change
Roundcube will ALWAYS redirect user to Password page (offered by official
Roundcube plugin password) until user changed the password.
iRedAdmin-Pro sets password last change date to the time when the account was
created, if you don't want to set the time, please set parameter
SET_PASSWORD_CHANGE_DATE_FOR_NEW_USER to False in config file
/opt/www/iredadmin/settings.py, then restart iredadmin service:
SET_PASSWORD_CHANGE_DATE_FOR_NEW_USER = False