Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of the cPanel servers I am running has constant troubles with compromised email accounts. I believe many of the users on this server have very weak passwords. I have increased the minimum password security, but that only takes effect when passwords are changed... Is there any way to force a one-time password change for all cPanel accounts and cPanel email addresses? This way I could force all users to generate new, secure passwords.


UPDATE: I have found that each account has files at ~/etc/domain.name/{passwd,shadow} which contain Unix-style passwd and shadow files for all email accounts. However, if I edit them manually I am still able to send email :-(

If I can locate the file which exim uses to authenticate users and mangle the passwords there, that would solve my issue...

share|improve this question
    
Is there no way to invalidate passwords? –  jcolebrand May 4 '12 at 15:20
    
That's what I am asking @jcolebrand... –  Josh May 4 '12 at 15:31
    
Are you asking about how to reset all user passwords yourself, prompting the customers to apply for a lost password, or are you asking about how to force the users to change their password upon next login? –  Joe May 4 '12 at 16:01
    
Either one would do @Joe. I was thinking the former: change all email account passwords to some random string, and require the account owners to reset them within the master account admin. But as long as I can somehow force all users to make their passwords secure, I am happy. –  Josh May 4 '12 at 16:22

2 Answers 2

Can you use the Security Policies to force a 'change date' of tomorrow? I'm thinking if you set a Password Age of 1 day, it will force them all to expire this time tomorrow. Once they're all expired, you can remove the limitation.

share|improve this answer
    
Unfortunately this is for the cPanel account and not for the email accounts within each cPanel account... :-( –  Josh May 4 '12 at 17:13
    
I apologize, I didn't understand this was a tiered deployment. Hold please. –  JohnThePro May 4 '12 at 17:14
    
Done and done. :) –  JohnThePro May 4 '12 at 17:22
    
Thanks. I was thinking of trying this, but I was unsure if it would work. Also, doesn't it mean that everyone will have to reset their passwords on the same day? I may just have to use a 30 day limit... –  Josh May 4 '12 at 17:58
    
Yes, everyone will have to do it on the same day. Isn't that what you were going for? Instantaneous? –  JohnThePro May 4 '12 at 20:15
up vote 0 down vote accepted

As of cPanel 11.34.1.4 (CURRENT release at the time of writing), this is now a standard feature under Account Functions »Force Password Change.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.