Along with email encryption and the use of digital signatures, one of the most effective and cost-effective ways to protect email from hacking is a good password security policy. Passwords written down on paper, stored in public files, or simply not strong enough are always a big breach in the information security of an enterprise and can lead to serious incidents with tangible business consequences. That is why any enterprise should have a strict password security policy.
However, any security officer knows that a password policy will only bring results if it not only exists, but is strictly observed by everyone, or at least by key employees of the organization. Achieving this is harder than it looks. Already heavily loaded employees constantly forget about the need to change the password, or follow the path of least resistance, each time making the password easier and simpler, thus nullifying the whole effect. That is why the issue of compliance with the password policy in enterprises is usually solved by various technical means.
Zimbra does not require any third-party applications to enforce password policy. This can be achieved using built-in tools.
First, itβs worth understanding how password management works in Zimbra. When a new account is created, it is assigned a temporary password by the administrator. After that, the user will be able to independently log into the account and change the password. All passwords are stored in encrypted form on the server with Zimbra and due to this they are inaccessible even to the server administrator. That is why if the user forgets the password, he will have to create a new one. Recall that until recently, creating a new password required the participation of an administrator, but the latest version of Zimbra Creative Suite 8.8.9 added the ability for users to set a new password themselves.
Password policy settings can be found in the settings for individual users and user groups. You can set up:
- Password length - allows you to set the minimum and maximum password length. By default, the minimum password length is 6 characters and the maximum is 64.
- Password aging - allows you to set the time after which the password becomes invalid. Users do not have to wait for the password to expire, they can be changed before the password expires
- Minimum upper case characters - allows you to set the minimum number of upper case characters used in the password
- Minimum lower case characters - allows you to set the minimum number of lower case characters used in the password
- Minimum numeric characters - allows you to set the minimum number of digits from 0 to 9 used in the password
- Minimum punctuation symbols - allows you to set the minimum number of punctuation marks and special characters used in the password
- Enforce password history - allows you to set the number of passwords to remember so that the user does not periodically use repeated passwords
- Password locked - this option allows you to prevent the user from changing the password
- Enable failed log in lockout - this option allows you to configure the system reaction to entering an incorrect password
As you can see, the password settings in Zimbra are quite flexible and able to adapt to the password policy in almost any enterprise. In addition, by using a simple script, you can send reminders to users that their password is about to expire. Thanks to such a reminder, the employee will be able to change the password in a relaxed atmosphere, while the mail that does not open in the morning at the employee who missed the moment of changing the password can adversely affect his efficiency.
In order for this script to work, you need to copy it to a file and make this file executable. It is recommended to automate the execution of this script using Cron so that it notifies users who have not updated their password daily that it will soon stop working. In addition, in the script, instead of zimbra.server.com, you must substitute the name of your own domain.
#!/bin/bash
# ΠΠ°Π΄Π°Π΅ΠΌ ΡΡΠ΄ ΠΏΠ΅ΡΠ΅ΠΌΠ΅Π½Π½ΡΡ
:
# Π‘ΠΏΠ΅ΡΠ²Π° ΠΊΠΎΠ»ΠΈΡΠ΅ΡΡΠ²ΠΎ Π΄Π½Π΅ΠΉ Π΄Π»Ρ ΠΏΠ΅ΡΠ²ΠΎΠ³ΠΎ Π½Π°ΠΏΠΎΠΌΠΈΠ½Π°Π½ΠΈΡ, Π·Π°ΡΠ΅ΠΌ Π΄Π»Ρ ΠΏΠΎΡΠ»Π΅Π΄Π½Π΅Π³ΠΎ:
FIRST="3"
LAST="1"
# ΠΠ°Π΄Π°Π΅ΠΌ Π°Π΄ΡΠ΅Ρ ΠΎΡΠΏΡΠ°Π²ΠΈΡΠ΅Π»Ρ:
FROM="[email protected]"
# ΠΠ°Π΄Π°Π΅ΠΌ Π°Π΄ΡΠ΅Ρ ΠΏΠΎΠ»ΡΡΠ°ΡΠ΅Π»Ρ, ΠΊΠΎΡΠΎΡΡΠΉ Π±ΡΠ΄Π΅Ρ ΠΏΠΎΠ»ΡΡΠ°ΡΡ ΠΏΠΈΡΡΠΌΠΎ ΡΠΎ ΡΠΏΠΈΡΠΊΠΎΠΌ Π°ΠΊΠΊΠ°ΡΠ½ΡΠΎΠ² Ρ ΠΈΡΡΠ΅ΠΊΡΠΈΠΌΠΈ ΠΏΠ°ΡΠΎΠ»ΡΠΌΠΈ
ADMIN_RECIPIENT="[email protected]"
# Π£ΠΊΠ°Π·ΡΠ²Π°Π΅ΠΌ ΠΏΡΡΡ ΠΊ ΠΈΡΠΏΠΎΠ»Π½ΡΠ΅ΠΌΠΎΠΌΡ ΡΠ°ΠΉΠ»Ρ Sendmail
SENDMAIL=$(ionice -c3 find /opt/zimbra/common/sbin/sendmail* -type f -iname sendmail)
# ΠΠΎΠ»ΡΡΠ°Π΅ΠΌ ΡΠΏΠΈΡΠΎΠΊ Π²ΡΠ΅Ρ
ΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°ΡΠ΅Π»Π΅ΠΉ.
USERS=$(ionice -c3 /opt/zimbra/bin/zmprov -l gaa $DOMAIN)
# Π£ΠΊΠ°Π·ΡΠ²Π°Π΅ΠΌ Π΄Π°ΡΡ Ρ ΡΠΎΡΠ½ΠΎΡΡΡΡ Π΄ΠΎ ΡΠ΅ΠΊΡΠ½Π΄Ρ:
DATE=$(date +%s)
# ΠΡΠΎΠ²Π΅ΡΡΠ΅ΠΌ ΠΊΠ°ΠΆΠ΄ΠΎΠ³ΠΎ ΠΈΠ· Π½ΠΈΡ
:
for USER in $USERS
do
# Π£Π·Π½Π°Π΅ΠΌ, ΠΊΠΎΠ³Π΄Π° Π±ΡΠ» ΡΡΡΠ°Π½ΠΎΠ²Π»Π΅Π½ ΠΏΠ°ΡΠΎΠ»Ρ
USERINFO=$(ionice -c3 /opt/zimbra/bin/zmprov ga "$USER")
PASS_SET_DATE=$(echo "$USERINFO" | grep zimbraPasswordModifiedTime: | cut -d " " -f 2 | cut -c 1-8)
PASS_MAX_AGE=$(echo "$USERINFO" | grep "zimbraPasswordMaxAge:" | cut -d " " -f 2)
NAME=$(echo "$USERINFO" | grep givenName | cut -d " " -f 2)
# ΠΡΠΎΠ²Π΅ΡΡΠ΅ΠΌ, Π½Π΅Ρ Π»ΠΈ ΡΡΠ΅Π΄ΠΈ ΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°ΡΠ΅Π»Π΅ΠΉ ΡΠ΅Ρ
, Ρ ΠΊΠΎΠ³ΠΎ ΡΡΠΎΠΊ Π΄Π΅ΠΉΡΡΠ²ΠΈΡ ΠΏΠ°ΡΠΎΠ»Ρ ΡΠΆΠ΅ ΠΈΡΡΠ΅ΠΊ.
if [[ "$PASS_MAX_AGE" -eq "0" ]]
then
continue
fi
# ΠΡΡΡΠΈΡΡΠ²Π°Π΅ΠΌ Π΄Π°ΡΡ ΠΎΠΊΠΎΠ½ΡΠ°Π½ΠΈΡ Π΄Π΅ΠΉΡΡΠ²ΠΈΡ ΠΏΠ°ΡΠΎΠ»Π΅ΠΉ
EXPIRES=$(date -d "$PASS_SET_DATE $PASS_MAX_AGE days" +%s)
# Π‘ΡΠΈΡΠ°Π΅ΠΌ, ΡΠΊΠΎΠ»ΡΠΊΠΎ Π΄Π½Π΅ΠΉ ΠΎΡΡΠ°Π»ΠΎΡΡ Π΄ΠΎ ΠΎΠΊΠΎΠ½ΡΠ°Π½ΠΈΡ ΡΡΠΎΠΊΠ° Π΄Π΅ΠΉΡΡΠ²ΠΈΡ ΠΏΠ°ΡΠΎΠ»Ρ
DEADLINE=$(( (($DATE - $EXPIRES)) / -86400 ))
# ΠΡΠΏΡΠ°Π²Π»ΡΠ΅ΠΌ ΠΏΠΈΡΡΠΌΠΎ ΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°ΡΠ΅Π»ΡΠΌ
SUBJECT="$NAME - ΠΠ°Ρ ΠΏΠ°ΡΠΎΠ»Ρ ΡΡΠ°Π½Π΅Ρ Π½Π΅Π΄Π΅ΠΉΡΡΠ²ΠΈΡΠ΅Π»ΡΠ½ΡΠΌ ΡΠ΅ΡΠ΅Π· $DEADLINE Π΄Π½Π΅ΠΉ"
BODY="
ΠΠ΄ΡΠ°Π²ΡΡΠ²ΡΠΉΡΠ΅, $NAME,
ΠΠ°ΡΠΎΠ»Ρ Π²Π°ΡΠ΅Π³ΠΎ Π°ΠΊΠΊΠ°ΡΠ½ΡΠ° ΡΡΠ°Π½Π΅Ρ Π½Π΅Π΄Π΅ΠΉΡΡΠ²ΠΈΡΠ΅Π»ΡΠ½ΡΠΌ ΡΠ΅ΡΠ΅Π· $DEADLINE Π΄Π½Π΅ΠΉ, ΠΠΎΠΆΠ°Π»ΡΠΉΡΡΠ°, ΡΠΎΠ·Π΄Π°ΠΉΡΠ΅ Π½ΠΎΠ²ΡΠΉ ΠΊΠ°ΠΊ ΠΌΠΎΠΆΠ½ΠΎ ΡΠΊΠΎΡΠ΅Π΅.
ΠΡ ΠΌΠΎΠΆΠ΅ΡΠ΅ ΡΠ°ΠΊΠΆΠ΅ ΡΠΎΠ·Π΄Π°ΡΡ Π½Π°ΠΏΠΎΠΌΠΈΠ½Π°Π½ΠΈΠ΅ ΠΎ ΡΠΌΠ΅Π½Π΅ ΠΏΠ°ΡΠΎΠ»Ρ Π² ΠΊΠ°Π»Π΅Π½Π΄Π°ΡΠ΅ Zimbra.
ΠΠ°ΡΠ°Π½Π΅Π΅ ΡΠΏΠ°ΡΠΈΠ±ΠΎ.
Π‘ ΡΠ²Π°ΠΆΠ΅Π½ΠΈΠ΅ΠΌ, IT-ΠΎΡΠ΄Π΅Π»
"
# ΠΠ΅ΡΠ²ΠΎΠ΅ ΠΏΡΠ΅Π΄ΡΠΏΡΠ΅ΠΆΠ΄Π΅Π½ΠΈΠ΅
if [[ "$DEADLINE" -eq "$FIRST" ]]
then
echo "Subject: $SUBJECT" "$BODY" | $SENDMAIL -f "$FROM" "$USER"
echo "Reminder email sent to: $USER - $DEADLINE days left"
# ΠΠΎΡΠ»Π΅Π΄Π½Π΅Π΅ ΠΏΡΠ΅Π΄ΡΠΏΡΠ΅ΠΆΠ΄Π΅Π½ΠΈΠ΅
elif [[ "$DEADLINE" -eq "$LAST" ]]
then
echo "Subject: $SUBJECT" "$BODY" | $SENDMAIL -f "$FROM" "$USER"
echo "Reminder email sent to: $USER - $DEADLINE days left"
# Final
elif [[ "$DEADLINE" -eq "1" ]]
then
echo "Subject: $SUBJECT" "$BODY" | $SENDMAIL -f "$FROM" "$USER"
echo "Last chance for: $USER - $DEADLINE days left"
fi
done
Thus, we can say that Zimbra Collaboration Suite is quite suitable even for those enterprises that have implemented a strict password policy, and thanks to the built-in functions, it will be quite simple to achieve its strict implementation from employees.
For all questions related to Zextras Suite, you can contact the Representative of Zextras company Katerina Triandafilidi by e-mail [email protected]
Source: habr.com