hmLoadTopic({
hmKeywords:"Account Options,Account Options Passwords,Passwords,Passwords,Passwords Expiration,Passwords Non-reversible,Passwords Strong",
hmTitle:"Passwords",
hmDescription:"Strong Passwords Require strong passwords By default, MDaemon requires strong passwords when creating new accounts or changing existing passwords. Clear this check box if you w",
hmPrevLink:"account_db--creating_a_new_system_data_source.html",
hmNextLink:"misc--quotas.html",
hmParentLink:"index.html",
hmBreadCrumbs:"Accounts Menu &gt; Account Settings &gt; Other",
hmTitlePath:"Accounts Menu > Account Settings > Other > Passwords",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">Passwords<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:32.5000rem;height:31.8125rem;border:none\" src=\".\/images\/passwords.png\"\/><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Strong Passwords<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Require strong passwords<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default, MDaemon requires strong passwords when creating new accounts or changing existing passwords. Clear this check box if you wish to disable the strong password requirement.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Strong passwords must:<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">Meet the minimum length requirement.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">Contain upper and lower case letters.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">Contain letters and numbers.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">Contain a special character (if the special character option is set below)<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">Not contain the user\'s full name or mailbox name.<\/span><\/p>\n\r<p class=\"p_List12_LastItem\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12_LastItem\">Not be found in the bad passwords file.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Minimum password length (at least 8 characters)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use this option to set the minimum password length required for strong passwords. This must be set to at least 8 characters, but a higher value is recommended.<\/span><span class=\"f_ControlIndent\"> The default value for new MDaemon installations is 10 characters. Changing this setting does not automatically trigger a required password change for accounts with passwords shorter than the new minimum, but when those users next change their password this setting will be enforced.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">Regardless of the minimum setting, passwords can be longer than 72 characters when the &quot;<\/span><span class=\"f_Notes\" style=\"font-style: italic;\">Store mailbox passwords using non-reversible encryption<\/span><span class=\"f_Notes\">&quot; option below is set. If that option is disabled, passwords can be no longer than 15 characters.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Passwords must contain a special character<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default for new MDaemon installations, strong passwords also require at least one of the following special characters: !&quot;#\$%&amp;\'()*+,-.\/:;&lt;=&gt;?@[\\]^_`{|}~. Disable this option if you do not wish to require a special character in strong passwords.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Edit the bad password file<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this button to edit the bad password file. Entries listed in this file are case insensitive and cannot be used as passwords. If you wish to create more complex or versatile entries, you can use <a href=\"cf_using_regular_expressions_in_content_filter.html\" class=\"topiclink\">Regular Expressions<\/a> to do so. Entries beginning with &quot;!&quot; are treated as Regular Expressions.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Force weak passwords to change<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this button if you wish to force all accounts with a weak password to change their passwords. This will lock out every account with a weak password until the password is changed. The password can be changed by an administrator via the MDaemon interface, or a locked out user can change the password via Webmail or the remote administration interface. When the user attempts to log in using the old password, he or she will be required to create a new one before proceeding.<\/span><span class=\"f_ControlIndent\"> <\/span><span class=\"f_ControlIndent\" style=\"font-weight: bold;\">Note:<\/span><span class=\"f_ControlIndent\"> This option is not available when using the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Store mailbox passwords using non-reversible encryption<\/span><span class=\"f_ControlIndent\">&quot; option below.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Report weak passwords<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this button to generate a report of all MDaemon accounts with a weak password. The report will be emailed to whatever email address you specify after clicking OK.<\/span><span class=\"f_ControlIndent\"> <\/span><span class=\"f_ControlIndent\" style=\"font-weight: bold;\">Note:<\/span><span class=\"f_ControlIndent\"> This option is not available when using the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Store mailbox passwords using non-reversible encryption<\/span><span class=\"f_ControlIndent\">&quot; option below.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Password Settings<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Passwords expire after this many days (0=passwords never expire)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use this option if you wish to set a maximum number of days that an account can be accessed before being required to change its password. The default value in this option is &quot;0&quot;, which means that passwords never expire. But if you set it to, for example, 30 days then the user will have 30 days to change his or her password, <\/span><span class=\"f_ControlIndent\" style=\"font-weight: bold;\">starting from the last time the account\'s password was changed<\/span><span class=\"f_ControlIndent\">. Therefore when you initially set an expiration value, any account with a password that hasn\'t been changed within the specified number of days will immediately have an expired password. When a user\'s password expires he or she will not be able to access POP, IMAP, SMTP, Webmail, or Remote Administration. The user can, however, still connect to Webmail or Remote Administration where he or she will then be required to change the password before proceeding. Email clients such as Outlook, Thunderbird, and the like cannot be used to change the password. Further, many clients will not even show a helpful error message to users, therefore they may need administrator assistance to figure out why their login is failing.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/forbidden_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">In order for users to be able to change their passwords via Webmail or Remote Administration they must first be granted the &quot;...edit password&quot; web access permission on the  <a href=\"template-manager_web-services.html\" class=\"topiclink\">Web Services<\/a> screen. Further, because changing the password may not be easy or possible for some users, you should exercise caution before using this option.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Warn users of password expiration each day for [xx] days (0 = never)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Accounts with a password that is about to expire can receive a daily reminder email that the password needs to be changed. Use this option to designate the number of days before the password expires that you want MDaemon to start sending these daily emails.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Remember this many old passwords (0=none)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use this option to specify the number of old passwords that you want MDaemon to remember for each user. When users change their passwords they will not be allowed to reuse old passwords. This option is set to &quot;0&quot; (disabled) by default.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Store mailbox passwords using non-reversible encryption<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Check this box if you want MDaemon to store passwords using non-reversible encryption. This protects the passwords from being decrypted by MDaemon, the administrator, or a possible attacker. To do this, MDaemon uses the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Bcrypt\" target=\"_blank\" class=\"weblink\" title=\"bcrypt\">bcrypt<\/a> password hashing function, which allows for longer passwords (up to 72 characters), and for passwords to be preserved yet not revealed when exporting and importing accounts. Some features, however, are not compatible with this option, such as weak password detection and <a href=\"default-domain-and-servers_servers.html\" class=\"topiclink\">APOP &amp; CRAM-MD5<\/a> authentication, because they depend on MDaemon being able to decrypt passwords. Non-reversible passwords is enabled by default.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Compromised Passwords<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">MDaemon can check a user\'s password against a compromised password list from a third-party service. It is able to do this without transmitting the password to the service, and if a user\'s password is present on the list it does not mean the account has been hacked. It means that someone somewhere has used the same characters as their password and it has appeared in a data breach. Published passwords may be used by hackers in dictionary attacks, but unique passwords that have never been used anywhere else are more secure. See <a href=\"https:\/\/haveibeenpwned.com\/Passwords\" target=\"_blank\" class=\"weblink\">Pwned Passwords<\/a> for more information.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Do not allow passwords found in third-party compromised passwords list<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Check this box if you do not wish to allow an account\'s password to be set to one that is found in the compromised password list.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Check for compromised password at login and send warning email up to every [xx] days (0 = never)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">With this option you can automatically check each user\'s password against the compromised passwords list once every specified number of days, when each user logs in. If they are found to be using a compromised password, a warning email is sent to the account and the postmaster. The warning emails can be customized by editing message template files in the <\/span><span class=\"f_PlainText\">\\MDaemon\\App<\/span><span class=\"f_ControlIndent\"> folder. Since instructions for how a user should change their password may depend on whether the account is using a password stored in MDaemon or using <a href=\"active-directory_overview.html\" class=\"topiclink\">Active Directory<\/a> authentication, there are two template files: <\/span><span class=\"f_PlainText\">CompromisedPasswordMD.dat<\/span><span class=\"f_ControlIndent\"> and <\/span><span class=\"f_PlainText\">CompromisedPasswordAD.dat<\/span><span class=\"f_ControlIndent\">. Macros can be used to personalize the message, change the subject, change the recipients, and so on.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">App Passwords<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\"><a href=\"ae_app_passwords.html\" class=\"topiclink\">App Passwords<\/a> is an option that can be used to make accounts more secure by creating very strong, randomly generated passwords to be used only in email clients and email apps, since those apps can\'t be secured by <a href=\"ae_worldclient_webadmin.html\" class=\"topiclink\">Two-Factor Authentication<\/a> (2FA). See: <a href=\"ae_app_passwords.html\" class=\"topiclink\">App Passwords<\/a>.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Enable app passwords<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">All users can create App Passwords for their accounts by default, when signed in to Webmail using Two-Factor Authentication. If you wish to disable App Password support for a specific user, you can do so with the <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\"><a href=\"ae_worldclient_webadmin.html\" class=\"topiclink\">...edit app passwords<\/a><\/span><span class=\"f_ControlIndent\"> option on the user\'s Web Services page.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Require Two-Factor Auth to set up app passwords<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">By default, users must be signed in to Webmail using <a href=\"ae_worldclient_webadmin.html\" class=\"topiclink\">Two-Factor Authentication<\/a> (2FA) in order to create a new App Password. Disabling this requirement is not recommended. <a href=\"ae_administrative_roles.html\" class=\"topiclink\">Global Administrators<\/a> are exempt from this requirement in MDRA, but it is still recommended that they always use 2FA when signing it to MDRA or Webmail.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Delete app passwords when account password is changed<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">By default, when an account\'s password is changed, all app passwords will be deleted, requiring the user to create new ones if he wishes to use them or is required to use them by the &quot;<\/span><span class=\"f_ControlIndent2\" style=\"font-style: italic;\">Require app passwords...<\/span><span class=\"f_ControlIndent2\">&quot; setting (see note below).<\/span><\/p>\n\r<p class=\"p_NoFormat\"><span class=\"f_NoFormat\">&nbsp;<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">There is an account option on the <a href=\"ae_options.html\" class=\"topiclink\">Account Editor\'s Settings<\/a> page that you can use to &quot;<\/span><span class=\"f_Notes\" style=\"font-style: italic;\">Require app password to log in to SMTP, IMAP, ActiveSync, etc.<\/span><span class=\"f_Notes\">&quot;<\/span><\/p>\n\r<p class=\"p_Notes\"><span class=\"f_Notes\">Requiring App Passwords can help protect an account\'s password from dictionary and brute force attacks via SMTP, IMAP, etc. This is more secure because even if an attack of this sort were to guess an account\'s actual password, it wouldn\'t work and the attacker wouldn\'t know, because MDaemon would only accept a correct App Password. Additionally, if your accounts in MDaemon are using <a href=\"active-directory_overview.html\" class=\"topiclink\">Active Directory<\/a> authentication and Active Directory locks an account after a number of failed attempts, this option can help prevent accounts from being locked out, because MDaemon will only check the App Passwords, not try to authenticate to Active Directory.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_SeeAlso\" style=\"page-break-after: avoid; border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_SeeAlso\">See:<\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"ae_account.html\" class=\"topiclink\">Account Editor » Account Details<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"ae_worldclient_webadmin.html\" class=\"topiclink\">Account Editor » Web Services<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"ae_app_passwords.html\" class=\"topiclink\">Account Editor » App Passwords<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"cf_using_regular_expressions_in_content_filter.html\" class=\"topiclink\">Regular Expressions<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\">&nbsp;<\/span><\/p>\n\r"
})
