Password Requirements

To ensure the security of the mail server and its mailboxes, system administrators can specify minimum requirements for user passwords. This includes things like setting requirements for how a password is generated (character count, upper/lowercase, etc.) as well as whether passwords expire, whether previous passwords can be used, and more. Because this page is scoped to the entire mail server, the values configured here become the security floor for every domain hosted on the box — not just a single domain.

These settings are then propagated down to domain administrators who can add to the password requirements for their own users. Domain administrators can not edit any requirements set at the system level, they can only add to those settings. (Any setting configured at the system level will appear greyed out for domain administrators.)

Note: Technically, SmarterMail enforces this relationship by folding the system-level values into each domain's own rule set the moment a domain administrator opens their password requirements: if a requirement is turned on here (a character class, common-password prevention, previous-password blocking, etc.), the matching toggle is forced on for every domain and can't be switched off. Any minimum values you set — minimum length, previous-passwords-to-block, or auto-block grace period — become floors; a domain administrator can only raise them further for their own domain, never lower them below what's configured here.

When accessing Password Requirements, the following tabs are available, and each tab has its own cards:

Options
Password Violations
Expired Passwords
Password Age

Options

This page allows a system administrator to set up the actual requirements users need to follow when creating passwords. These settings, then, are used as the baseline should a domain administrator want to increase the requirements.

Note: Domain administrators cannot lessen requirements set by the system administrator, they can only increase the requirements.

Note: Out of the box, on a freshly installed server, SmarterMail's system-level defaults already require a minimum of 8 characters, at least one capital letter, one lowercase letter, and one number, that the password not match the username, and that the password not appear on the built-in list of common passwords. Requiring a symbol and blocking password reuse are not enabled by default — you'll need to turn those on explicitly if your organization's security policy calls for them.

Requirements

Minimum Password Length - Enter the minimum number of characters the password must have. SmarterMail will not let you set this below 3 characters, regardless of what you enter, and the default out of the box is 8.
At least one number - Select this option to force users to include a number in the password.
At least one capital letter - Select this option to force users to include a capital letter in the password.
At least one lowercase letter - Select this option to force users to include a lowercase letter in the password.
At least one symbol - Select this option to force users to include a symbol in the password. A symbol is any character that isn't a letter, digit, or whitespace — for example !, @, #, or $.
May not match username - Select this option to ensure that the username and password do not match. As an example, if enabled, the user jsmith@example.com would not be allowed to set their password to jsmith.

Options

Prevent common passwords - Select this option to prevent users from configuring passwords that are included in the list of commonly used, insecure passwords — things like "password", "qwerty", and "letmein". SmarterMail ships with a built-in list of roughly 500 known-weak passwords (stored on the server in a common-passwords.json file) and checks any new password against it as an exact match, in addition to (not instead of) whatever character-class requirements are configured above.
Prevent previous passwords reuse - Select this option to prevent users from using any previously used passwords.

Previous Passwords to Block - Some administrators will allow re-use of passwords after a certain amount of time, or after some number of rotations. This number reflects the number of times a new password needs to be used before a password can be re-used. By default, this is set to 0, meaning passwords can never be re-used — SmarterMail checks the new password against the user's entire password history, not just a recent window of it. Setting this to, say, 5 means a user could reuse an old password only after five different passwords have come after it.

Skip enforcement for existing passwords - Select this option to skip existing users when making changes to password requirements — meaning the changes will only affect new users or new passwords.

Note: This option only bypasses the character- class, common-password, and reuse checks for passwords that were already in place before you tightened the requirements. It has no effect on the separate password expiration settings below — if a user's password has already expired under the "Expiration" rules, they'll still be forced to change it at their next login even with this option enabled.

Enable password retrieval - Select this option to allow users to reset their password if they forget it.

Note: In order for users to utilize password retrieval, they must have a Recovery Address configured in their account settings.

Expiration

Password expiration is based on the date/age of the user's current password, NOT when the password expiration setting is enabled. This means that users who have not changed their passwords in a long time will be required to change them almost immediately upon enabling the "Passwords expire automatically" setting.

As an example, let's say you enabled password expiration today and set the threshold to 1 month. This is the expected behavior for the following user scenarios:

If the user changed their password last week, their password will not be expired. Instead, it will expire in 3 weeks (when the password is 1 month old).
IF the user changed their password last year, their password is over the 1-month threshold and will be expired immediately.
If the user was created 2 weeks ago and has never changed their password, their password will not be expired. Instead, it will expire in 2 weeks (when the password is 1 month old).
If the user was created 2 months ago and has never changed their password, their password is over the 1-month threshold and will be expired immediately.

Note: Password expiration only ever applies to accounts that authenticate directly against SmarterMail. Users whose accounts authenticate through Active Directory are exempt from expiration entirely — SmarterMail doesn't store or manage their password, so it has no way to enforce an expiration date against it. AD password age and complexity are governed by your domain controller's own policies instead.

Initially, "Passwords expire automatically" is disabled. Enabling it offers the following settings:

Password Expiration (Months) - The number of months that a password is valid. After the specified time, a user's outgoing SMTP will be disabled and a password change will be forced upon Web interface login. Move the slider to the right to enable this setting. The value must be at least 1 month, and the default once enabled is 12 months.

Note: If a user's 'Disable password changes' setting is enabled, their password will not expire, and they're also exempt from the auto-block/violation enforcement described below. This is a per-user setting (found on the user's own account settings), and it's typically reserved for shared or service mailboxes where no individual is expected to periodically log in and change a password — for example, a monitoring mailbox that only receives automated alerts.

User Notification Timing (Days separated by commas) - The interval(s) used to notify users of when their password will expire or when their auto-block grace period will end and, subsequently, their outgoing SMTP will be disabled. The default values are 28, 14, 7, 3, 2, 1 days. This means SmarterMail will send out warning messages to the user to change their password 28 days, 14 days, 7 days, 3 days, 2 days and 1 day before their password officially expires or the grace period ends if their password violates the requirements.

Note: SmarterMail will send one, single notification for all missed intervals. For example, imagine "Auto-block Grace Period" is set for 30 days and the "User Notification Timing" is set at 60, 45, 25, 10, 2, 1. When a user is in violation, SmarterMail will send a single notification for the 60 and 45-day intervals then continue as normal at the 25-day interval.

Disable outbound mail after grace period ends - Select this option to disable outgoing SMTP after the auto-block grace period ends when a user's password does not meet the password requirements.
Auto-block Grace Period (Days) - Available when the "Disable outbound mail..." setting is enabled. This is the number of days a user can wait to update their password before outgoing SMTP is disabled due to password policy violation. The value can be set as low as 0 (an immediate block the moment a violation is detected), and the default is 30 days.

Note: This setting only applies if the "Disable outgoing SMTP when auto-block grace period ends" setting is enabled.

Password Violations

The Password Violations tab offers system administrators a way to find users that aren't following the password requirements that have been set up. For any Users who appear on this list, the system administrator is able to either email the users individually, or force their non-compliant password to expire. This latter action means that the user will be forced to change their password the next time they log in to their email account. In addition, it's possible to export a list of the non-compliant users in CSV format.

Note: This list is recalculated every time you load the page — it isn't a static snapshot. SmarterMail re-checks every user's current password against the current Options settings above, so if you tighten the requirements today (for example, by requiring a symbol that wasn't required before), users whose existing passwords no longer meet the new rules will immediately start showing up here, even though nothing about their own password changed.

Note: Only accounts that authenticate directly against SmarterMail can appear on this list. Active Directory-authenticated accounts are excluded, since SmarterMail has no visibility into (or control over) a password that's actually validated by your domain controller.

When Users appear on this page, the following information will be available:

Username - The username of the non-compliant account
Two-Factor Authentication - Whether the username has Two-Factor Authentication enabled. This is shown for context only; it has no effect on password compliance one way or the other. It's useful, though, for spotting accounts that combine a non-compliant password with no additional authentication factor — good candidates to prioritize.
Password Changes Disabled - If a specific user has the ability to change their password disabled, their user is marked accordingly in this column.
Violations - The number of password requirement violations encountered for the User. This is a count of how many distinct rules the current password breaks (length, missing a required character class, matching the username, appearing on the common-password list, or reusing a previous password) — not a count of login attempts or incidents.

Two actions are available for the users selected in this list:

Send Email - Opens a modal window that lets you compose and send a custom email (subject and body are fully editable) to the selected user or users, informing them that their password doesn't meet the current requirements.
Expire Password - Immediately marks the selected user(s)' password as expired, forcing a password change the next time they log in — effectively skipping the grace period and notification schedule described under Expiration above.

Expired Passwords

By default, this tab displays all SmarterMail-authenticated accounts set up on the server. The numbers displayed on the tab show the number of passwords that have expired over the total number of accounts set up. For example, that tab may show 10/1232, meaning 10 accounts out of 1232 total have passwords that have expired. This tab could, of course, also show 0/1232 if there are no expired passwords.

Note: As with the Violations tab, Active Directory-authenticated accounts are excluded from both the list and the count here. Since expiration is only ever enforced against SmarterMail-managed passwords, an AD account can never legitimately show up as "expired" in SmarterMail's eyes.

Depending on the business rules used by the system administrator, they have some actions that can be performed on each account, which are detailed below. Each account is listed and the following information is displayed:

Username - The account that is set up.
Two-Factor Authentication - Whether the username has Two-Factor Authentication enabled.
Expired - If the user's password is expired, a check mark appears in this column.
Password Age - How old the password is, measured from the date it was last changed. For example, 2 years, 3 days, 15 minutes, etc.

As mentioned, administrators have the ability to take action on users, either users who have expired passwords or users who do not. These actions include:

Send Email - Opens a modal window that allows the administrator to create, and send, an email to the user(s) informing them that they need to reset their password. However, the administrator can customize the entire message to say what they want.
Expire Password - Will automatically expire password(s) for the user(s), forcing a change the next time the user attempts to log in.

Password Age

By default, this page will list all SmarterMail-authenticated users and the respective age of the passwords assigned to each. This allows system administrators to find users who may, due to the age of their password, want to change said password. In addition, it can help find little-used accounts that may be ripe for compromise if their password is over a certain age. Each account is listed and the following information is displayed:

Note: Just like the Expired Passwords tab, this list excludes Active Directory-authenticated accounts, since SmarterMail never sees (and therefore can't age-track) a password that lives in your directory service instead of in SmarterMail itself.

Username - The account that is set up.
Two-Factor Authentication - Whether the username has Two-Factor Authentication enabled.
Expired - If the user's password is expired, a check mark appears in this column.
Password Age - How old the password is, displayed as a relative value (for example, "12 days," "4 months," or "2 years") rather than an exact date, so you can scan the list for stale passwords at a glance. As an example, an account that hasn't had its password changed since it was created two years ago will simply read "2 years" here, regardless of whether password expiration is even enabled.