Need to set Secure Password Policy on Zimbra? We can help you.

By default, Zimbra does not enforce any strong password requirements for a user account.

Here, at Bobcares, we assist our clients with similar queries on a daily basis.

Set Secure Password Policy on Zimbra

For a zimbra server in production, ready to use, our Server Engineers suggest an effective way to set it up.

First, we have to check the current password settings on the Zimbra server. This is done using the commands:

$ sudo su – zimbra
$ zmprov gac -v | grep Password | sort | uniq
zimbraFeatureChangePasswordEnabled: TRUEzimbra
MobilePolicyAllowSimpleDevicePassword: FALSE
zimbraMobilePolicyAlphanumericDevicePasswordRequired: FALSEzimbraMobilePolicyDevicePasswordEnabled: TRUE
zimbraMobilePolicyDevicePasswordExpiration: 0zimbraMobilePolicyDevicePasswordHistory: 8
zimbraMobilePolicyMaxDevicePasswordFailedAttempts: 4
zimbraMobilePolicyMinDevicePasswordComplexCharacters: 0
zimbraMobilePolicyMinDevicePasswordLength: 4
zimbraMobilePolicyPasswordRecoveryEnabled: TRUE
zimbraPasswordEnforceHistory: 0
zimbraPasswordLocked: FALSE
zimbraPasswordLockoutDuration: 1h
zimbraPasswordLockoutEnabled: FALSE
zimbraPasswordLockoutFailureLifetime: 1h
zimbraPasswordLockoutMaxFailures: 10
zimbraPasswordMaxAge: 0
zimbraPasswordMaxLength: 64
zimbraPasswordMinAge: 0
zimbraPasswordMinAlphaChars: 0
zimbraPasswordMinDigitsOrPuncs: 0
zimbraPasswordMinLength: 6
zimbraPasswordMinLowerCaseChars: 0
zimbraPasswordMinNumericChars: 0
zimbraPasswordMinPunctuationChars: 0
zimbraPasswordMinUpperCaseChars: 0
zimbraPasswordMinUpperCaseChars: 1

Generally, the key items to be keen on are:

• zimbraPasswordMaxAge: Set the maximum time the password will remain valid
• zimbraPasswordLockoutMaxFailures: The number of failed login attempts
• zimbraPasswordMinLength: The minimum length of the password
• zimbraPasswordMinNumericChars: The minimum number of numeric characters in the password
• zimbraPasswordMinUpperCaseChars: The minimum number of uppercase character required in a password

Now that we have seen the key parameters we need to modify, let us apply them to the server. The settings will be:

zimbraPasswordMaxAge: 90 –> In days
zimbraPasswordMinLength: 7
zimbraPasswordLockoutMaxFailures: 5
zimbraPasswordMinNumericChars: 1
zimbraPasswordMinUpperCaseChars: 1

Change password policy settings on Zimbra Admin web interface.

We can also set password policy from web UI.

To do so, navigate to: Home > Configure > Class of Service > default | defaultExternal > Advanced

On the page, there is a section for password policy modification. Here, change the values and save.

Changing password policy settings on Zimbra CLI

We can change the settings from the CLI. The syntax for this is:

$ zmprov mc <cos-name> <parameter> <value>

Then, if we do not know the list of class of service, check with the command:

$ zmprov gac
default
defaultExternal

For more details about a particular cos, we use:

$ zmprov gc default

For example, to ensure there is an uppercase character and a number on the password, we use:

$ sudo su – zimbra
$ zmprov mc default zimbraPasswordMinNumericChars 1
$ zmprov mc default zimbraPasswordMinUpperCaseChars 1
$ zmprov mc default zimbraPasswordLockoutMaxFailures 5

Then, follow the same syntax for all other parameters which can be changed.

[Need help to Set Secure Password Policy on Zimbra? We are happy to assist.]

Conclusion

To conclude, Zimbra does not enforce any strong password requirements for a user account. This poses a risk of the account being compromised and ultimately used for spamming. Today, we saw how our Support Techs go about this issue.