Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of the cPanel servers I am running has constant troubles with compromised email accounts. I believe many of the users on this server have very weak passwords. I have increased the minimum password security, but that only takes effect when passwords are changed... Is there any way to force a one-time password change for all cPanel accounts and cPanel email addresses? This way I could force all users to generate new, secure passwords.

UPDATE: I have found that each account has files at ~/etc/{passwd,shadow} which contain Unix-style passwd and shadow files for all email accounts. However, if I edit them manually I am still able to send email :-(

If I can locate the file which exim uses to authenticate users and mangle the passwords there, that would solve my issue...

share|improve this question

closed as off-topic by HopelessN00b Jan 13 '15 at 23:46

  • This question does not appear to be about server, networking, or related infrastructure administration within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

Is there no way to invalidate passwords? – jcolebrand May 4 '12 at 15:20
That's what I am asking @jcolebrand... – Josh May 4 '12 at 15:31
Are you asking about how to reset all user passwords yourself, prompting the customers to apply for a lost password, or are you asking about how to force the users to change their password upon next login? – Joe May 4 '12 at 16:01
Either one would do @Joe. I was thinking the former: change all email account passwords to some random string, and require the account owners to reset them within the master account admin. But as long as I can somehow force all users to make their passwords secure, I am happy. – Josh May 4 '12 at 16:22
This question appears to be off-topic because it is about working with a service provider's management interface, such as cPanel. – HopelessN00b Jan 13 '15 at 23:46

Can you use the Security Policies to force a 'change date' of tomorrow? I'm thinking if you set a Password Age of 1 day, it will force them all to expire this time tomorrow. Once they're all expired, you can remove the limitation.

share|improve this answer
Unfortunately this is for the cPanel account and not for the email accounts within each cPanel account... :-( – Josh May 4 '12 at 17:13
I apologize, I didn't understand this was a tiered deployment. Hold please. – JohnThePro May 4 '12 at 17:14
Done and done. :) – JohnThePro May 4 '12 at 17:22
Thanks. I was thinking of trying this, but I was unsure if it would work. Also, doesn't it mean that everyone will have to reset their passwords on the same day? I may just have to use a 30 day limit... – Josh May 4 '12 at 17:58
Yes, everyone will have to do it on the same day. Isn't that what you were going for? Instantaneous? – JohnThePro May 4 '12 at 20:15
up vote 1 down vote accepted

As of cPanel (CURRENT release at the time of writing), this is now a standard feature under Account Functions »Force Password Change.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.