Bobcares

wesupport

CLIENT AREACall Us 1-800-383-5193
Bobcares

wesupport

Call Us 1-800-383-5193
Bobcares

wesupport

Call Us 1-800-383-5193

Need help?

Our experts have had an average response time of 11.7 minutes in August 2021 to fix urgent issues.

We will keep your servers stable, secure, and fast at all times for one fixed price.

Secure Password Policy on Zimbra – Set it now

by | Dec 16, 2020

Need to set Secure Password Policy on Zimbra? We can help you.

By default, Zimbra does not enforce any strong password requirements for a user account.

Here, at Bobcares, we assist our clients with similar queries on a daily basis.

 

Set Secure Password Policy on Zimbra

For a zimbra server in production, ready to use, our Server Engineers suggest an effective way to set it up.

First, we have to check the current password settings on the Zimbra server. This is done using the commands:

$ sudo su – zimbra
$ zmprov gac -v | grep Password | sort | uniq
zimbraFeatureChangePasswordEnabled: TRUEzimbra
MobilePolicyAllowSimpleDevicePassword: FALSE
zimbraMobilePolicyAlphanumericDevicePasswordRequired: FALSEzimbraMobilePolicyDevicePasswordEnabled: TRUE
zimbraMobilePolicyDevicePasswordExpiration: 0zimbraMobilePolicyDevicePasswordHistory: 8
zimbraMobilePolicyMaxDevicePasswordFailedAttempts: 4
zimbraMobilePolicyMinDevicePasswordComplexCharacters: 0
zimbraMobilePolicyMinDevicePasswordLength: 4
zimbraMobilePolicyPasswordRecoveryEnabled: TRUE
zimbraPasswordEnforceHistory: 0
zimbraPasswordLocked: FALSE
zimbraPasswordLockoutDuration: 1h
zimbraPasswordLockoutEnabled: FALSE
zimbraPasswordLockoutFailureLifetime: 1h
zimbraPasswordLockoutMaxFailures: 10
zimbraPasswordMaxAge: 0
zimbraPasswordMaxLength: 64
zimbraPasswordMinAge: 0
zimbraPasswordMinAlphaChars: 0
zimbraPasswordMinDigitsOrPuncs: 0
zimbraPasswordMinLength: 6
zimbraPasswordMinLowerCaseChars: 0
zimbraPasswordMinNumericChars: 0
zimbraPasswordMinPunctuationChars: 0
zimbraPasswordMinUpperCaseChars: 0
zimbraPasswordMinUpperCaseChars: 1

Generally, the key items to be keen on are:

  • zimbraPasswordMaxAge: Set the maximum time the password will remain valid
  • zimbraPasswordLockoutMaxFailures: The number of failed login attempts
  • zimbraPasswordMinLength: The minimum length of the password
  • zimbraPasswordMinNumericChars: The minimum number of numeric characters in the password
  • zimbraPasswordMinUpperCaseChars: The minimum number of uppercase character required in a password

 

Now that we have seen the key parameters we need to modify, let us apply them to the server. The settings will be:

zimbraPasswordMaxAge: 90 –> In days
zimbraPasswordMinLength: 7
zimbraPasswordLockoutMaxFailures: 5
zimbraPasswordMinNumericChars: 1
zimbraPasswordMinUpperCaseChars: 1

 

Change password policy settings on Zimbra Admin web interface.

We can also set password policy from web UI.

To do so, navigate to: Home > Configure > Class of Service > default | defaultExternal > Advanced

On the page, there is a section for password policy modification. Here, change the values and save.

 

Changing password policy settings on Zimbra CLI

We can change the settings from the CLI. The syntax for this is:

$ zmprov mc <cos-name> <parameter> <value>

Then, if we do not know the list of class of service, check with the command:

$ zmprov gac
default
defaultExternal

For more details about a particular cos, we use:

$ zmprov gc default

For example, to ensure there is an uppercase character and a number on the password, we use:

$ sudo su – zimbra
$ zmprov mc default zimbraPasswordMinNumericChars 1
$ zmprov mc default zimbraPasswordMinUpperCaseChars 1
$ zmprov mc default zimbraPasswordLockoutMaxFailures 5

Then, follow the same syntax for all other parameters which can be changed.

[Need help to Set Secure Password Policy on Zimbra? We are happy to assist.]

 

Conclusion

To conclude, Zimbra does not enforce any strong password requirements for a user account. This poses a risk of the account being compromised and ultimately used for spamming. Today, we saw how our Support Techs go about this issue.

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Categories

Tags