Re: minimum password length/character combination support?
Tom Collins <[email protected]> Wed, 29 Oct 2014 16:32:43 -0700
| Newsgroups | gmane.mail.vpopmail |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_CF6D83EF-26C7-4332-8858-581D6DC2EFE4 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=utf-8 I haven't checked the configuration in some time, so I don't know about minimum password requirements. I did recall this patch on SourceForge to call out to cracklib and require a strong password. If you're comfortable with Javascript, you could modify the change password screen to dynamically update a password status (weak, strong, secure) and only enable the "change" button when both password fields match and meet minimum password requirements. -Tom On Oct 29, 2014, at 11:08 AM, <[email protected]> <[email protected]> wrote: > Tom, > > Thanks for the reply. Of course, sorry for the naïve query. Yes we use qmailadmin to allow password changes by end users. > > And we’ve just found a writeup here: > http://mugurel.sumanariu.ro/qmail/qmailadmin-check-if-password-is-strong-enough/ > but it seems a little dodgy. > > There isn’t by any chance a build time variable for qmail admin or something a little more within the source tree than the above patch method? > > Thanks again for your reply. > > > Sincerely, > > Peter Brezny > Purplecat Networks Inc. > www.purplecat.net > 828-250-9446 > > From: Tom Collins > Sent: Wednesday, October 29, 2014 1:56 PM > To: [email protected] > > The vchkpw program verifies the password. Are you wondering about the vpasswd program for changing a password? That's an admin program, and wouldn't typically enforce a password change policy. > > How do your users currently change their passwords? QmailAdmin? Some other program? You would have to incorporate password requirements into that program, and not the one that validates a password. > > -Tom > > > On Oct 29, 2014, at 7:42 AM, Peter Brezny wrote: > > Dear [email protected], > > > > Is there a way to enforce a minimum length and character combination > > (letters, numbers, upper case) with vchkpw and if not, are there patches or > > external applications that integrate well with vchkpw to get this > > functionality? > > > > > !DSPAM:5451791d26511096114170! --Apple-Mail=_CF6D83EF-26C7-4332-8858-581D6DC2EFE4 Content-Transfer-Encoding: 8bit Content-Type: text/html; charset=utf-8 <html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I haven't checked the configuration in some time, so I don't know about minimum password requirements.<div><br></div><div>I did recall this patch on SourceForge to call out to cracklib and require a strong password.</div><div><br></div><div>If you're comfortable with Javascript, you could modify the change password screen to dynamically update a password status (weak, strong, secure) and only enable the "change" button when both password fields match and meet minimum password requirements.<br><div><br><div> <span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><div>-Tom</div><br class="Apple-interchange-newline"></span> </div> <br><div><div>On Oct 29, 2014, at 11:08 AM, <<a href="mailto:[email protected]">[email protected]</a>> <<a href="mailto:[email protected]">[email protected]</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: 'Color Emoji', Calibri, 'Segoe UI', Meiryo, 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', sans-serif; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decoration s-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div dir="ltr"><div data-externalstyle="false" dir="ltr" style="font-family: Calibri, 'Segoe UI', Meiryo, 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', sans-serif; font-size: 12pt; "><div>Tom,</div><div><br></div><div>Thanks for the reply. Of course, sorry for the naïve query. Yes we use qmailadmin to allow password changes by end users.</div><div><br></div><div>And we’ve just found a writeup here:</div><div><a href="http://mugurel.sumanariu.ro/qmail/qmailadmin-check-if-password-is-strong-enough/" target="_parent">http://mugurel.sumanariu.ro/qmail/qmailadmin-check-if-password-is-strong-enough/</a></div><div>but it seems a little dodgy.</div><div><br></d iv><div>There isn’t by any chance a build time variable for qmail admin or something a little more within the source tree than the above patch method?</div><div><br></div><div>Thanks again for your reply.</div><div><br></div><div data-signatureblock="true"><div><br></div><div>Sincerely,<br><br>Peter Brezny<br>Purplecat Networks Inc.<br><a href="http://www.purplecat.net/">www.purplecat.net</a><br>828-250-9446</div><div><br></div></div><div style="padding-top: 5px; border-top-color: rgb(229, 229, 229); border-top-width: 1px; border-top-style: solid; "><div><font face=" 'Calibri', 'Segoe UI', 'Meiryo', 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'sans-serif'" style="line-height: 15pt; letter-spacing: 0.02em; font-family: Calibri, 'Segoe UI', Meiryo, 'Microsoft YaHei UI ', 'Microsoft JhengHei UI', 'Malgun Gothic', sans-serif; font-size: 12pt; "><b>From:</b> <a href="mailto:[email protected]" target="_parent">Tom Collins</a><br><b>Sent:</b> Wednesday, October 29, 2014 1:56 PM<br><b>To:</b> <a href="mailto:[email protected]" target="_parent">[email protected]</a></font></div></div><div><br></div><div dir=""><div id="readingPaneBodyContent">The vchkpw program verifies the password. Are you wondering about the vpasswd program for changing a password? That's an admin program, and wouldn't typically enforce a password change policy.<br><br>How do your users currently change their passwords? QmailAdmin? Some other program? You would have to incorporate password requirements into th at program, and not the one that validates a password.<br><br>-Tom<br><br><br>On Oct 29, 2014, at 7:42 AM, Peter Brezny wrote:<br>> Dear<span class="Apple-converted-space"> </span><a href="mailto:[email protected]">[email protected]</a>,<br>><span class="Apple-converted-space"> </span><br>> Is there a way to enforce a minimum length and character combination<br>> (letters, numbers, upper case) with vchkpw and if not, are there patches or<br>> external applications that integrate well with vchkpw to get this<br>> functionality?<br><br><br><br><br></div></div></div></div></span></blockquote></div><br></div></div> !DSPAM:5451791d26511096114170! </body></html> --Apple-Mail=_CF6D83EF-26C7-4332-8858-581D6DC2EFE4--