36
|
1 <?php
|
|
2
|
|
3 // Password Plugin options
|
|
4 // -----------------------
|
|
5 // A driver to use for password change. Default: "sql".
|
|
6 // See README file for list of supported driver names.
|
|
7 $config['password_driver'] = 'sql';
|
|
8
|
|
9 // Determine whether current password is required to change password.
|
|
10 // Default: false.
|
|
11 $config['password_confirm_current'] = true;
|
|
12
|
|
13 // Require the new password to be a certain length.
|
|
14 // set to blank to allow passwords of any length
|
|
15 $config['password_minimum_length'] = 0;
|
|
16
|
|
17 // Require the new password to contain a letter and punctuation character
|
|
18 // Change to false to remove this check.
|
|
19 $config['password_require_nonalpha'] = false;
|
|
20
|
|
21 // Enables logging of password changes into logs/password
|
|
22 $config['password_log'] = false;
|
|
23
|
|
24 // Comma-separated list of login exceptions for which password change
|
|
25 // will be not available (no Password tab in Settings)
|
|
26 $config['password_login_exceptions'] = null;
|
|
27
|
|
28 // Array of hosts that support password changing.
|
|
29 // Listed hosts will feature a Password option in Settings; others will not.
|
|
30 // Example: array('mail.example.com', 'mail2.example.org');
|
|
31 // Default is NULL (all hosts supported).
|
|
32 $config['password_hosts'] = null;
|
|
33
|
|
34 // Enables saving the new password even if it matches the old password. Useful
|
|
35 // for upgrading the stored passwords after the encryption scheme has changed.
|
|
36 $config['password_force_save'] = false;
|
|
37
|
|
38 // Enables forcing new users to change their password at their first login.
|
|
39 $config['password_force_new_user'] = false;
|
|
40
|
|
41 // Default password hashing/crypting algorithm.
|
|
42 // Possible options: des-crypt, ext-des-crypt, md5-crypt, blowfish-crypt,
|
|
43 // sha256-crypt, sha512-crypt, md5, sha, smd5, ssha, samba, ad, dovecot, clear.
|
|
44 // For details see password::hash_password() method.
|
|
45 $config['password_algorithm'] = 'clear';
|
|
46
|
|
47 // Password prefix (e.g. {CRYPT}, {SHA}) for passwords generated
|
|
48 // using password_algorithm above. Default: empty.
|
|
49 $config['password_algorithm_prefix'] = '';
|
|
50
|
|
51 // Path for dovecotpw/doveadm-pw (if not in the $PATH).
|
|
52 // Used for password_algorithm = 'dovecot'.
|
|
53 $config['password_dovecotpw'] = '/usr/doveadm pw'; // for dovecot-2.x
|
|
54 //$config['password_dovecotpw'] = '/usr/local/sbin/dovecotpw'; // for dovecot-1.x
|
|
55
|
|
56 // Dovecot password scheme.
|
|
57 // Used for password_algorithm = 'dovecot'.
|
|
58 $config['password_dovecotpw_method'] = 'CRAM-MD5';
|
|
59
|
|
60 // Enables use of password with method prefix, e.g. {MD5}$1$LUiMYWqx$fEkg/ggr/L6Mb2X7be4i1/
|
|
61 // when using password_algorithm=dovecot
|
|
62 $config['password_dovecotpw_with_method'] = false;
|
|
63
|
|
64 // Iteration count parameter for Blowfish-based hashing algo.
|
|
65 // It must be between 4 and 31. Default: 12.
|
|
66 // Be aware, the higher the value, the longer it takes to generate the password hashes.
|
|
67 $config['password_blowfish_cost'] = 12;
|
|
68
|
|
69 // Number of rounds for the sha256 and sha512 crypt hashing algorithms.
|
|
70 // Must be at least 1000. If not set, then the number of rounds is left up
|
|
71 // to the crypt() implementation. On glibc this defaults to 5000.
|
|
72 // Be aware, the higher the value, the longer it takes to generate the password hashes.
|
|
73 //$config['password_crypt_rounds'] = 50000;
|
|
74
|
|
75 // This option temporarily disables the password change functionality.
|
|
76 // Use it when the users database server is in maintenance mode or sth like that.
|
|
77 // You can set it to TRUE/FALSE or a text describing the reason
|
|
78 // which will replace the default.
|
|
79 $config['password_disabled'] = false;
|
|
80
|
|
81
|
|
82 // SQL Driver options
|
|
83 // ------------------
|
|
84 // PEAR database DSN for performing the query. By default
|
|
85 // Roundcube DB settings are used.
|
|
86 $config['password_db_dsn'] = '';
|
|
87
|
|
88 // The SQL query used to change the password.
|
|
89 // The query can contain the following macros that will be expanded as follows:
|
|
90 // %p is replaced with the plaintext new password
|
|
91 // %P is replaced with the crypted/hashed new password
|
|
92 // according to configured password_method
|
|
93 // %o is replaced with the old (current) password
|
|
94 // %O is replaced with the crypted/hashed old (current) password
|
|
95 // according to configured password_method
|
|
96 // %h is replaced with the imap host (from the session info)
|
|
97 // %u is replaced with the username (from the session info)
|
|
98 // %l is replaced with the local part of the username
|
|
99 // (in case the username is an email address)
|
|
100 // %d is replaced with the domain part of the username
|
|
101 // (in case the username is an email address)
|
|
102 // Deprecated macros:
|
|
103 // %c is replaced with the crypt version of the new password, MD5 if available
|
|
104 // otherwise DES. More hash function can be enabled using the password_crypt_hash
|
|
105 // configuration parameter.
|
|
106 // %D is replaced with the dovecotpw-crypted version of the new password
|
|
107 // %n is replaced with the hashed version of the new password
|
|
108 // %q is replaced with the hashed password before the change
|
|
109 // Escaping of macros is handled by this module.
|
|
110 // Default: "SELECT update_passwd(%c, %u)"
|
|
111 $config['password_query'] = 'SELECT update_passwd(%c, %u)';
|
|
112
|
|
113 // By default the crypt() function which is used to create the %c
|
|
114 // parameter uses the md5 algorithm (deprecated, use %P).
|
|
115 // You can choose between: des, md5, blowfish, sha256, sha512.
|
|
116 $config['password_crypt_hash'] = 'md5';
|
|
117
|
|
118 // By default domains in variables are using unicode.
|
|
119 // Enable this option to use punycoded names
|
|
120 $config['password_idn_ascii'] = false;
|
|
121
|
|
122 // Using a password hash for %n and %q variables (deprecated, use %P).
|
|
123 // Determine which hashing algorithm should be used to generate
|
|
124 // the hashed new and current password for using them within the
|
|
125 // SQL query. Requires PHP's 'hash' extension.
|
|
126 $config['password_hash_algorithm'] = 'sha1';
|
|
127
|
|
128 // You can also decide whether the hash should be provided
|
|
129 // as hex string or in base64 encoded format.
|
|
130 $config['password_hash_base64'] = false;
|
|
131
|
|
132
|
|
133 // Poppassd Driver options
|
|
134 // -----------------------
|
|
135 // The host which changes the password (default: localhost)
|
|
136 // Supported replacement variables:
|
|
137 // %n - hostname ($_SERVER['SERVER_NAME'])
|
|
138 // %t - hostname without the first part
|
|
139 // %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
|
|
140 // %h - IMAP host
|
|
141 // %z - IMAP domain without first part
|
|
142 // %s - domain name after the '@' from e-mail address provided at login screen
|
|
143 $config['password_pop_host'] = 'localhost';
|
|
144
|
|
145 // TCP port used for poppassd connections (default: 106)
|
|
146 $config['password_pop_port'] = 106;
|
|
147
|
|
148
|
|
149 // SASL Driver options
|
|
150 // -------------------
|
|
151 // Additional arguments for the saslpasswd2 call
|
|
152 $config['password_saslpasswd_args'] = '';
|
|
153
|
|
154
|
|
155 // LDAP and LDAP_SIMPLE Driver options
|
|
156 // -----------------------------------
|
|
157 // LDAP server name to connect to.
|
|
158 // You can provide one or several hosts in an array in which case the hosts are tried from left to right.
|
|
159 // Exemple: array('ldap1.exemple.com', 'ldap2.exemple.com');
|
|
160 // Default: 'localhost'
|
|
161 $config['password_ldap_host'] = 'localhost';
|
|
162
|
|
163 // LDAP server port to connect to
|
|
164 // Default: '389'
|
|
165 $config['password_ldap_port'] = '389';
|
|
166
|
|
167 // TLS is started after connecting
|
|
168 // Using TLS for password modification is recommended.
|
|
169 // Default: false
|
|
170 $config['password_ldap_starttls'] = false;
|
|
171
|
|
172 // LDAP version
|
|
173 // Default: '3'
|
|
174 $config['password_ldap_version'] = '3';
|
|
175
|
|
176 // LDAP base name (root directory)
|
|
177 // Exemple: 'dc=exemple,dc=com'
|
|
178 $config['password_ldap_basedn'] = 'dc=exemple,dc=com';
|
|
179
|
|
180 // LDAP connection method
|
|
181 // There are two connection methods for changing a user's LDAP password.
|
|
182 // 'user': use user credential (recommended, require password_confirm_current=true)
|
|
183 // 'admin': use admin credential (this mode require password_ldap_adminDN and password_ldap_adminPW)
|
|
184 // Default: 'user'
|
|
185 $config['password_ldap_method'] = 'user';
|
|
186
|
|
187 // LDAP Admin DN
|
|
188 // Used only in admin connection mode
|
|
189 // Default: null
|
|
190 $config['password_ldap_adminDN'] = null;
|
|
191
|
|
192 // LDAP Admin Password
|
|
193 // Used only in admin connection mode
|
|
194 // Default: null
|
|
195 $config['password_ldap_adminPW'] = null;
|
|
196
|
|
197 // LDAP user DN mask
|
|
198 // The user's DN is mandatory and as we only have his login,
|
|
199 // we need to re-create his DN using a mask
|
|
200 // '%login' will be replaced by the current roundcube user's login
|
|
201 // '%name' will be replaced by the current roundcube user's name part
|
|
202 // '%domain' will be replaced by the current roundcube user's domain part
|
|
203 // '%dc' will be replaced by domain name hierarchal string e.g. "dc=test,dc=domain,dc=com"
|
|
204 // Exemple: 'uid=%login,ou=people,dc=exemple,dc=com'
|
|
205 $config['password_ldap_userDN_mask'] = 'uid=%login,ou=people,dc=exemple,dc=com';
|
|
206
|
|
207 // LDAP search DN
|
|
208 // The DN roundcube should bind with to find out user's DN
|
|
209 // based on his login. Note that you should comment out the default
|
|
210 // password_ldap_userDN_mask setting for this to take effect.
|
|
211 // Use this if you cannot specify a general template for user DN with
|
|
212 // password_ldap_userDN_mask. You need to perform a search based on
|
|
213 // users login to find his DN instead. A common reason might be that
|
|
214 // your users are placed under different ou's like engineering or
|
|
215 // sales which cannot be derived from their login only.
|
|
216 $config['password_ldap_searchDN'] = 'cn=roundcube,ou=services,dc=example,dc=com';
|
|
217
|
|
218 // LDAP search password
|
|
219 // If password_ldap_searchDN is set, the password to use for
|
|
220 // binding to search for user's DN. Note that you should comment out the default
|
|
221 // password_ldap_userDN_mask setting for this to take effect.
|
|
222 // Warning: Be sure to set approperiate permissions on this file so this password
|
|
223 // is only accesible to roundcube and don't forget to restrict roundcube's access to
|
|
224 // your directory as much as possible using ACLs. Should this password be compromised
|
|
225 // you want to minimize the damage.
|
|
226 $config['password_ldap_searchPW'] = 'secret';
|
|
227
|
|
228 // LDAP search base
|
|
229 // If password_ldap_searchDN is set, the base to search in using the filter below.
|
|
230 // Note that you should comment out the default password_ldap_userDN_mask setting
|
|
231 // for this to take effect.
|
|
232 $config['password_ldap_search_base'] = 'ou=people,dc=example,dc=com';
|
|
233
|
|
234 // LDAP search filter
|
|
235 // If password_ldap_searchDN is set, the filter to use when
|
|
236 // searching for user's DN. Note that you should comment out the default
|
|
237 // password_ldap_userDN_mask setting for this to take effect.
|
|
238 // '%login' will be replaced by the current roundcube user's login
|
|
239 // '%name' will be replaced by the current roundcube user's name part
|
|
240 // '%domain' will be replaced by the current roundcube user's domain part
|
|
241 // '%dc' will be replaced by domain name hierarchal string e.g. "dc=test,dc=domain,dc=com"
|
|
242 // Example: '(uid=%login)'
|
|
243 // Example: '(&(objectClass=posixAccount)(uid=%login))'
|
|
244 $config['password_ldap_search_filter'] = '(uid=%login)';
|
|
245
|
|
246 // LDAP password hash type
|
|
247 // Standard LDAP encryption type which must be one of: crypt,
|
|
248 // ext_des, md5crypt, blowfish, md5, sha, smd5, ssha, ad, cram-md5 (dovecot style) or clear.
|
|
249 // Set to 'default' if you want to use method specified in password_algorithm option above.
|
|
250 // Multiple password Values can be generated by concatenating encodings with a +. E.g. 'cram-md5+crypt'
|
|
251 // Default: 'crypt'.
|
|
252 $config['password_ldap_encodage'] = 'crypt';
|
|
253
|
|
254 // LDAP password attribute
|
|
255 // Name of the ldap's attribute used for storing user password
|
|
256 // Default: 'userPassword'
|
|
257 $config['password_ldap_pwattr'] = 'userPassword';
|
|
258
|
|
259 // LDAP password force replace
|
|
260 // Force LDAP replace in cases where ACL allows only replace not read
|
|
261 // See http://pear.php.net/package/Net_LDAP2/docs/latest/Net_LDAP2/Net_LDAP2_Entry.html#methodreplace
|
|
262 // Default: true
|
|
263 $config['password_ldap_force_replace'] = true;
|
|
264
|
|
265 // LDAP Password Last Change Date
|
|
266 // Some places use an attribute to store the date of the last password change
|
|
267 // The date is meassured in "days since epoch" (an integer value)
|
|
268 // Whenever the password is changed, the attribute will be updated if set (e.g. shadowLastChange)
|
|
269 $config['password_ldap_lchattr'] = '';
|
|
270
|
|
271 // LDAP Samba password attribute, e.g. sambaNTPassword
|
|
272 // Name of the LDAP's Samba attribute used for storing user password
|
|
273 $config['password_ldap_samba_pwattr'] = '';
|
|
274
|
|
275 // LDAP Samba Password Last Change Date attribute, e.g. sambaPwdLastSet
|
|
276 // Some places use an attribute to store the date of the last password change
|
|
277 // The date is meassured in "seconds since epoch" (an integer value)
|
|
278 // Whenever the password is changed, the attribute will be updated if set
|
|
279 $config['password_ldap_samba_lchattr'] = '';
|
|
280
|
|
281 // LDAP PPolicy Driver options
|
|
282 // -----------------------------------
|
|
283
|
|
284 // LDAP Change password command - filename of the perl script
|
|
285 // Example: 'change_ldap_pass.pl'
|
|
286 $config['password_ldap_ppolicy_cmd'] = 'change_ldap_pass.pl';
|
|
287
|
|
288 // LDAP URI
|
|
289 // Example: 'ldap://ldap.example.com/ ldaps://ldap2.example.com:636/'
|
|
290 $config['password_ldap_ppolicy_uri'] = 'ldap://localhost/';
|
|
291
|
|
292 // LDAP base name (root directory)
|
|
293 // Exemple: 'dc=exemple,dc=com'
|
|
294 $config['password_ldap_ppolicy_basedn'] = 'dc=example,dc=com';
|
|
295
|
|
296 $config['password_ldap_ppolicy_searchDN'] = 'cn=someuser,dc=example,dc=com';
|
|
297
|
|
298 $config['password_ldap_ppolicy_searchPW'] = 'secret';
|
|
299
|
|
300 // LDAP search filter
|
|
301 // Example: '(uid=%login)'
|
|
302 // Example: '(&(objectClass=posixAccount)(uid=%login))'
|
|
303 $config['password_ldap_ppolicy_search_filter'] = '(uid=%login)';
|
|
304
|
|
305 // CA Certificate file if in URI is LDAPS connection
|
|
306 $config['password_ldap_ppolicy_cafile'] = '/etc/ssl/cacert.crt';
|
|
307
|
|
308
|
|
309
|
|
310 // DirectAdmin Driver options
|
|
311 // --------------------------
|
|
312 // The host which changes the password
|
|
313 // Use 'ssl://host' instead of 'tcp://host' when running DirectAdmin over SSL.
|
|
314 // The host can contain the following macros that will be expanded as follows:
|
|
315 // %h is replaced with the imap host (from the session info)
|
|
316 // %d is replaced with the domain part of the username (if the username is an email)
|
|
317 $config['password_directadmin_host'] = 'tcp://localhost';
|
|
318
|
|
319 // TCP port used for DirectAdmin connections
|
|
320 $config['password_directadmin_port'] = 2222;
|
|
321
|
|
322
|
|
323 // vpopmaild Driver options
|
|
324 // -----------------------
|
|
325 // The host which changes the password
|
|
326 $config['password_vpopmaild_host'] = 'localhost';
|
|
327
|
|
328 // TCP port used for vpopmaild connections
|
|
329 $config['password_vpopmaild_port'] = 89;
|
|
330
|
|
331 // Timeout used for the connection to vpopmaild (in seconds)
|
|
332 $config['password_vpopmaild_timeout'] = 10;
|
|
333
|
|
334
|
|
335 // cPanel Driver options
|
|
336 // --------------------------
|
|
337 // The cPanel Host name
|
|
338 $config['password_cpanel_host'] = 'host.domain.com';
|
|
339
|
|
340 // The cPanel admin username
|
|
341 $config['password_cpanel_username'] = 'username';
|
|
342
|
|
343 // The cPanel admin password
|
|
344 $config['password_cpanel_password'] = 'password';
|
|
345
|
|
346 // The cPanel admin hash
|
|
347 // If you prefer to use a hash (Remote Access Key) instead of plain password, enter it below.
|
|
348 // Hash takes precedence over password auth.
|
|
349 // You can generate a Remote Access Key in WHM -> Clusters -> Remote Access Key
|
|
350 $config['password_cpanel_hash'] = '';
|
|
351
|
|
352 // The cPanel port to use
|
|
353 $config['password_cpanel_port'] = 2087;
|
|
354
|
|
355
|
|
356 // cPanel Webmail Driver options
|
|
357 // -----------------------------
|
|
358 // The cPanel Host name
|
|
359 $config['password_cpanel_webmail_host'] = 'host.domain.com';
|
|
360
|
|
361 // The cPanel port to use
|
|
362 $config['password_cpanel_webmail_port'] = 2096;
|
|
363
|
|
364
|
|
365 // XIMSS (Communigate server) Driver options
|
|
366 // -----------------------------------------
|
|
367 // Host name of the Communigate server
|
|
368 $config['password_ximss_host'] = 'mail.example.com';
|
|
369
|
|
370 // XIMSS port on Communigate server
|
|
371 $config['password_ximss_port'] = 11024;
|
|
372
|
|
373
|
|
374 // chpasswd Driver options
|
|
375 // ---------------------
|
|
376 // Command to use (see "Sudo setup" in README)
|
|
377 $config['password_chpasswd_cmd'] = 'sudo /usr/sbin/chpasswd 2> /dev/null';
|
|
378
|
|
379
|
|
380 // XMail Driver options
|
|
381 // ---------------------
|
|
382 $config['xmail_host'] = 'localhost';
|
|
383 $config['xmail_user'] = 'YourXmailControlUser';
|
|
384 $config['xmail_pass'] = 'YourXmailControlPass';
|
|
385 $config['xmail_port'] = 6017;
|
|
386
|
|
387
|
|
388 // hMail Driver options
|
|
389 // -----------------------
|
|
390 // Remote hMailServer configuration
|
|
391 // true: HMailserver is on a remote box (php.ini: com.allow_dcom = true)
|
|
392 // false: Hmailserver is on same box as PHP
|
|
393 $config['hmailserver_remote_dcom'] = false;
|
|
394 // Windows credentials
|
|
395 $config['hmailserver_server'] = array(
|
|
396 'Server' => 'localhost', // hostname or ip address
|
|
397 'Username' => 'administrator', // windows username
|
|
398 'Password' => 'password' // windows user password
|
|
399 );
|
|
400
|
|
401
|
|
402 // Virtualmin Driver options
|
|
403 // -------------------------
|
|
404 // Username format:
|
|
405 // 0: username@domain
|
|
406 // 1: username%domain
|
|
407 // 2: username.domain
|
|
408 // 3: domain.username
|
|
409 // 4: username-domain
|
|
410 // 5: domain-username
|
|
411 // 6: username_domain
|
|
412 // 7: domain_username
|
|
413 $config['password_virtualmin_format'] = 0;
|
|
414
|
|
415
|
|
416 // pw_usermod Driver options
|
|
417 // --------------------------
|
|
418 // Use comma delimited exlist to disable password change for users.
|
|
419 // See "Sudo setup" in README file.
|
|
420 $config['password_pw_usermod_cmd'] = 'sudo /usr/sbin/pw usermod -h 0 -n';
|
|
421
|
|
422
|
|
423 // DBMail Driver options
|
|
424 // -------------------
|
|
425 // Additional arguments for the dbmail-users call
|
|
426 $config['password_dbmail_args'] = '-p sha512';
|
|
427
|
|
428
|
|
429 // Expect Driver options
|
|
430 // ---------------------
|
|
431 // Location of expect binary
|
|
432 $config['password_expect_bin'] = '/usr/bin/expect';
|
|
433
|
|
434 // Location of expect script (see helpers/passwd-expect)
|
|
435 $config['password_expect_script'] = '';
|
|
436
|
|
437 // Arguments for the expect script. See the helpers/passwd-expect file for details.
|
|
438 // This is probably a good starting default:
|
|
439 // -telent -host localhost -output /tmp/passwd.log -log /tmp/passwd.log
|
|
440 $config['password_expect_params'] = '';
|
|
441
|
|
442
|
|
443 // smb Driver options
|
|
444 // ---------------------
|
|
445 // Samba host (default: localhost)
|
|
446 // Supported replacement variables:
|
|
447 // %n - hostname ($_SERVER['SERVER_NAME'])
|
|
448 // %t - hostname without the first part
|
|
449 // %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
|
|
450 $config['password_smb_host'] = 'localhost';
|
|
451 // Location of smbpasswd binary (default: /usr/bin/smbpasswd)
|
|
452 $config['password_smb_cmd'] = '/usr/bin/smbpasswd';
|
|
453
|
|
454 // gearman driver options
|
|
455 // ---------------------
|
|
456 // Gearman host (default: localhost)
|
|
457 $config['password_gearman_host'] = 'localhost';
|
|
458
|
|
459
|
|
460 // Plesk/PPA Driver options
|
|
461 // --------------------
|
|
462 // You need to allow RCP for IP of roundcube-server in Plesk/PPA Panel
|
|
463
|
|
464 // Plesk RCP Host
|
|
465 $config['password_plesk_host'] = '10.0.0.5';
|
|
466
|
|
467 // Plesk RPC Username
|
|
468 $config['password_plesk_user'] = 'admin';
|
|
469
|
|
470 // Plesk RPC Password
|
|
471 $config['password_plesk_pass'] = 'password';
|
|
472
|
|
473 // Plesk RPC Port
|
|
474 $config['password_plesk_rpc_port'] = '8443';
|
|
475
|
|
476 // Plesk RPC Path
|
|
477 $config['password_plesk_rpc_path'] = 'enterprise/control/agent.php';
|
|
478
|
|
479
|
|
480 // kasswd Driver options
|
|
481 // ---------------------
|
|
482 // Command to use
|
|
483 $config['password_kpasswd_cmd'] = '/usr/bin/kpasswd';
|