ZCS Administrator Guide 8.0

Network Edition

Managing Passwords

If you use internal authentication, you can quickly change an account's password from the Account’s toolbar. The user must be told the new password to log on.

Important: If Microsoft Active Directory (AD) is used for user authentication, you must disable the Change Password feature in the COS. The AD password policy is not managed by Zimbra.

If you want to make sure users change a password that you create, you can enable Must Change Password for the account. The user must change the password the next time he logs on.

Password restrictions can be set either at the COS level or at the account level. You can configure settings to require users to create strong passwords and change their passwords regularly, and you can set the parameters to lock out accounts when incorrect passwords are entered.

Direct Users to Your Change Password Page

If your ZWC authentication is configured as external auth, you can configure ZCS to direct users to your password change page when users change their passwords. You can either set this URL as a global setting or a per domain setting.

Set the zimbraChangePasswordURL attribute to the URL of your password change page. In ZWC. Change Password in Preferences > General links to this URL, and when passwords expire, users are sent to this page.

This is changed from the zmprov CLI. For domains, type

zmprov md exampledomain.com zimbraChangePasswordURL http://www.mysite.com

Configure a Password Policy

If internal authentication is configured for the domain, you can require users to create strong passwords to guard against simple password harvest attacks Users can be locked out of their accounts if they fail to sign in after the maximum number of attempts configured.

The password settings that can be configured are listed below.

Feature	Description
Minimum/Maximum password length	Specifies the required length of a password. The default minimum and maximum are 6 adn 64 characters, respectively.
Minimum /Maximum password age	Configures the passwsord expiration date. Users can change their passwords at any time between the minimum and maximum. They must change it when the maximum password age is reached.
Configuring the next settings requires users to create more complex passwords.
Minimum upper case characters	Uppercase A - Z
Minimum lower case characters	Lowercase a - z
Minimum punctuation symbols	Non-alphanumeric, for example !, $, #, &, %
Minimum numeric characters	Base 10 digits 0 - 9
Minimum number of unique passwords history	Number of unique new passwords that a user must create before an old password can be reused.
Password locked	Users cannot change their passwords.This should be set if authentication is external.
Must change password	User is required to change password at first sign in.
Change password	When enabled, users can change their password at any time within the password age settings from their account Preferences tab.