Bobcares

WeSupport

Call Us! 1-800-383-5193
Call Us! 1-800-383-5193
Call Us! 1-800-383-5193

Need Help?

Emergency Response Time custom

Our experts have had an average response time of 12.45 minutes in December 2020 to fix urgent issues.

We will keep your servers stable, secure and fast at all times for one fixed price.

Secure Password Policy on Zimbra – Set it now

by | Dec 16, 2020

Need to set Secure Password Policy on Zimbra? We can help you.

By default, Zimbra does not enforce any strong password requirements for a user account.

Here, at Bobcares, we assist our clients with similar queries on a daily basis.

 

Set Secure Password Policy on Zimbra

For a zimbra server in production, ready to use, our Server Engineers suggest an effective way to set it up.

First, we have to check the current password settings on the Zimbra server. This is done using the commands:

$ sudo su – zimbra
$ zmprov gac -v | grep Password | sort | uniq
zimbraFeatureChangePasswordEnabled: TRUEzimbra
MobilePolicyAllowSimpleDevicePassword: FALSE
zimbraMobilePolicyAlphanumericDevicePasswordRequired: FALSEzimbraMobilePolicyDevicePasswordEnabled: TRUE
zimbraMobilePolicyDevicePasswordExpiration: 0zimbraMobilePolicyDevicePasswordHistory: 8
zimbraMobilePolicyMaxDevicePasswordFailedAttempts: 4
zimbraMobilePolicyMinDevicePasswordComplexCharacters: 0
zimbraMobilePolicyMinDevicePasswordLength: 4
zimbraMobilePolicyPasswordRecoveryEnabled: TRUE
zimbraPasswordEnforceHistory: 0
zimbraPasswordLocked: FALSE
zimbraPasswordLockoutDuration: 1h
zimbraPasswordLockoutEnabled: FALSE
zimbraPasswordLockoutFailureLifetime: 1h
zimbraPasswordLockoutMaxFailures: 10
zimbraPasswordMaxAge: 0
zimbraPasswordMaxLength: 64
zimbraPasswordMinAge: 0
zimbraPasswordMinAlphaChars: 0
zimbraPasswordMinDigitsOrPuncs: 0
zimbraPasswordMinLength: 6
zimbraPasswordMinLowerCaseChars: 0
zimbraPasswordMinNumericChars: 0
zimbraPasswordMinPunctuationChars: 0
zimbraPasswordMinUpperCaseChars: 0
zimbraPasswordMinUpperCaseChars: 1

Generally, the key items to be keen on are:

  • zimbraPasswordMaxAge: Set the maximum time the password will remain valid
  • zimbraPasswordLockoutMaxFailures: The number of failed login attempts
  • zimbraPasswordMinLength: The minimum length of the password
  • zimbraPasswordMinNumericChars: The minimum number of numeric characters in the password
  • zimbraPasswordMinUpperCaseChars: The minimum number of uppercase character required in a password

 

Now that we have seen the key parameters we need to modify, let us apply them to the server. The settings will be:

zimbraPasswordMaxAge: 90 –> In days
zimbraPasswordMinLength: 7
zimbraPasswordLockoutMaxFailures: 5
zimbraPasswordMinNumericChars: 1
zimbraPasswordMinUpperCaseChars: 1

 

Change password policy settings on Zimbra Admin web interface.

We can also set password policy from web UI.

To do so, navigate to: Home > Configure > Class of Service > default | defaultExternal > Advanced

On the page, there is a section for password policy modification. Here, change the values and save.

 

Changing password policy settings on Zimbra CLI

We can change the settings from the CLI. The syntax for this is:

$ zmprov mc <cos-name> <parameter> <value>

Then, if we do not know the list of class of service, check with the command:

$ zmprov gac
default
defaultExternal

For more details about a particular cos, we use:

$ zmprov gc default

For example, to ensure there is an uppercase character and a number on the password, we use:

$ sudo su – zimbra
$ zmprov mc default zimbraPasswordMinNumericChars 1
$ zmprov mc default zimbraPasswordMinUpperCaseChars 1
$ zmprov mc default zimbraPasswordLockoutMaxFailures 5

Then, follow the same syntax for all other parameters which can be changed.

[Need help to Set Secure Password Policy on Zimbra? We are happy to assist.]

 

Conclusion

To conclude, Zimbra does not enforce any strong password requirements for a user account. This poses a risk of the account being compromised and ultimately used for spamming. Today, we saw how our Support Techs go about this issue.

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Privacy Preference Center

Necessary

Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

PHPSESSID - Preserves user session state across page requests.

gdpr[consent_types] - Used to store user consents.

gdpr[allowed_cookies] - Used to store user allowed cookies.

PHPSESSID, gdpr[consent_types], gdpr[allowed_cookies]
PHPSESSID
WHMCSpKDlPzh2chML

Statistics

Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

_ga - Preserves user session state across page requests.

_gat - Used by Google Analytics to throttle request rate

_gid - Registers a unique ID that is used to generate statistical data on how you use the website.

smartlookCookie - Used to collect user device and location information of the site visitors to improve the websites User Experience.

_ga, _gat, _gid
_ga, _gat, _gid
smartlookCookie

Marketing

Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.

IDE - Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.

test_cookie - Used to check if the user's browser supports cookies.

1P_JAR - Google cookie. These cookies are used to collect website statistics and track conversion rates.

NID - Registers a unique ID that identifies a returning user's device. The ID is used for serving ads that are most relevant to the user.

DV - Google ad personalisation

IDE, test_cookie, 1P_JAR, NID, DV, NID
IDE, test_cookie
1P_JAR, NID, DV
NID
hblid

Security

These are essential site cookies, used by the google reCAPTCHA. These cookies use an unique identifier to verify if a visitor is human or a bot.

SID, APISID, HSID, NID, PREF
SID, APISID, HSID, NID, PREF