Re: minimum password length/character combination support?
Nikolay Mitev <[email protected]> Sat, 1 Nov 2014 19:46:19 +0200
| Newsgroups | gmane.mail.vpopmail |
|---|---|
| Message-ID | <CALv4BhrVwgb__aowh5fLrP7Q=20SFAXzzkuEY4eEYBe=pqL=Ug@mail.gmail.com> |
--001a11c26314ec06140506cfb05c Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hello, I tested the patch, but an error occurs for qmailadmin-1.2.16-0.el6.x86_64. Could there be a new version of this patch. Best regards, Nikolay On Thu, Oct 30, 2014 at 1:37 AM, Tom Collins <[email protected]> wrote: > Sorry, forgot the link to the QmailAdmin patch: > http://sourceforge.net/p/qmailadmin/patches/28/ > > -Tom > > > On Oct 29, 2014, at 4:32 PM, Tom Collins wrote: > > I haven't checked the configuration in some time, so I don't know about > minimum password requirements. > > I did recall this patch on SourceForge to call out to cracklib and require > a strong password. > > If you're comfortable with Javascript, you could modify the change > password screen to dynamically update a password status (weak, strong, > secure) and only enable the "change" button when both password fields match > and meet minimum password requirements. > > -Tom > > > On Oct 29, 2014, at 11:08 AM, <[email protected]> < > [email protected]> wrote: > > Tom, > > Thanks for the reply. Of course, sorry for the naïve query. Yes we use > qmailadmin to allow password changes by end users. > > And we’ve just found a writeup here: > > http://mugurel.sumanariu.ro/qmail/qmailadmin-check-if-password-is-strong-enough/ > but it seems a little dodgy. > > There isn’t by any chance a build time variable for qmail admin or > something a little more within the source tree than the above patch method? > > Thanks again for your reply. > > > Sincerely, > > Peter Brezny > Purplecat Networks Inc. > www.purplecat.net > 828-250-9446 > > *From:* Tom Collins <[email protected]> > *Sent:* Wednesday, October 29, 2014 1:56 PM > *To:* [email protected] > > The vchkpw program verifies the password. Are you wondering about the > vpasswd program for changing a password? That's an admin program, and > wouldn't typically enforce a password change policy. > > How do your users currently change their passwords? QmailAdmin? Some > other program? You would have to incorporate password requirements into > that program, and not the one that validates a password. > > -Tom > > > On Oct 29, 2014, at 7:42 AM, Peter Brezny wrote: > > Dear [email protected], > > > > Is there a way to enforce a minimum length and character combination > > (letters, numbers, upper case) with vchkpw and if not, are there patches > or > > external applications that integrate well with vchkpw to get this > > functionality? > > > > > > > > !DSPAM:54551c6e26513275391490! --001a11c26314ec06140506cfb05c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit <div dir="ltr">Hello,<div><br></div><div>I tested the patch, but an error occurs for qmailadmin-1.2.16-0.el6.x86_64.<br></div><div>Could there be a new version of this patch.<br></div><div><br></div><div>Best regards,</div><div>Nikolay</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 30, 2014 at 1:37 AM, Tom Collins <span dir="ltr"><<a href="mailto:[email protected]" target="_blank">[email protected]</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word">Sorry, forgot the link to the QmailAdmin patch: <a href="http://sourceforge.net/p/qmailadmin/patches/28/" target="_blank">http://sourceforge.net/p/qmailadmin/patches/28/</a><div><br><div> <span style="border-collapse:separate;border-spacing:0px 0px;color:rgb(0,0,0);font-family:Helvetica;font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><div>-Tom</div><br></span> </div><div><div class="h5"> <br><div><div>On Oct 29, 2014, at 4:32 PM, Tom Collins wrote:</div><br><blockquote type="cite"><div style="word-wrap:break-word">I haven't checked the configuration in some time, so I don't know about minimum password requirements.<div><br></div><div>I did recall this patch on SourceForge to call out to cracklib and require a strong password.</div><div><br></div><div>If you're comfortable with Javascript, you could modify the change password screen to dynamically update a password status (weak, strong, secure) and only enable the "change" button when both password fields match and meet minimum password requirements.<br><div><br><div> <span style="border-collapse:separate;font-family:Helvetica;font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><div>-Tom</div><br></span> </div> <br><div><div>On Oct 29, 2014, at 11:08 AM, <<a href="mailto:[email protected]" target="_blank">[email protected]</a>> <<a href="mailto:[email protected]" target="_blank">[email protected]</a>> wrote:</div><br><blockquote type="cite"><span style="border-collapse:separate;font-family:'Color Emoji',Calibri,'Segoe UI',Meiryo,'Microsoft YaHei UI','Microsoft JhengHei UI','Malgun Gothic',sans-serif;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;font-size:medium"><div dir="ltr"><div dir="ltr" style="font-family:Calibri,'Segoe UI',Meiryo,'Microsoft YaHei UI','Microso ft JhengHei UI','Malgun Gothic',sans-serif;font-size:12pt"><div>Tom,</div><div><br></div><div>Thanks for the reply. Of course, sorry for the naïve query. Yes we use qmailadmin to allow password changes by end users.</div><div><br></div><div>And we’ve just found a writeup here:</div><div><a href="http://mugurel.sumanariu.ro/qmail/qmailadmin-check-if-password-is-strong-enough/" target="_blank">http://mugurel.sumanariu.ro/qmail/qmailadmin-check-if-password-is-strong-enough/</a></div><div>but it seems a little dodgy.</div><div><br></div><div>There isn’t by any chance a build time variable for qmail admin or something a little more within the source tree than the above patch method?</div><div><br></div><div>Thanks again for your reply.</div><div><br></div><div><div><br></ div><div>Sincerely,<br><br>Peter Brezny<br>Purplecat Networks Inc.<br><a href="http://www.purplecat.net/" target="_blank">www.purplecat.net</a><br><a href="tel:828-250-9446" value="+18282509446" target="_blank">828-250-9446</a></div><div><br></div></div><div style="padding-top:5px;border-top-color:rgb(229,229,229);border-top-width:1px;border-top-style:solid"><div><font face=" 'Calibri', 'Segoe UI', 'Meiryo', 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'sans-serif'" style="line-height:15pt;letter-spacing:0.02em;font-family:Calibri,'Segoe UI',Meiryo,'Microsoft YaHei UI','Microsoft JhengHei UI','Malgun Gothic',sans-serif;font-size:12pt"><b>From:</b> <a href="mailto:[email protected]" target="_blank">Tom Collins</a><br><b>Sent:</b> Wednesday, October 29, 2014 1:56 PM<br><b>To:</b> <a href="mailto:[email protected]" target="_blank">[email protected]</a></font></div></div><div><br></div><div dir=""><div>The vchkpw program verifies the password. Are you wondering about the vpasswd program for changing a password? That's an admin program, and wouldn't typically enforce a password change policy.<br><br>How do your users currently change their passwords? QmailAdmin? Some other program? You would have to incorporate password requirements into that program, and not the one that validates a password.<br><br>-Tom<br><br><br>On Oct 29, 2014, at 7:42 AM, Peter Brezny wrote:<br>> Dear<span> </span><a href="mailto:vchkpw@i nter7.com" target="_blank">[email protected]</a>,<br>><span> </span><br>> Is there a way to enforce a minimum length and character combination<br>> (letters, numbers, upper case) with vchkpw and if not, are there patches or<br>> external applications that integrate well with vchkpw to get this<br>> functionality?<br><br><br><br><br></div></div></div></div></span></blockquote></div><br></div></div> </div> </blockquote></div><br></div></div></div> </div> </blockquote></div><br></div> !DSPAM:54551c6e26513275391490! --001a11c26314ec06140506cfb05c--