Mailcow-dockerized: Changeable Password Policy

[thannaske]

Is your feature request related to a problem? Please describe.
I can't use password that consists of lowercase letters separated by hyphens (e.g. word-word-word-word) because it's missing a number, which is required by the current password policy.

Those kind of passwords are easy to remind while maintaining a high entropy. An example password that matches the above mentioned pattern could have an entropy of around 128 bit while a password that matches the current mailcow password policy (6 chars, letters and at least one number) wouldn't have a quarter of that entropy.

What I want to make clear is that the current (unchangeable) password policy denies a password of mine that has a high entropy just because there is no number in it and allows me to use a password that is way less secure just because I typed 6 chars including a number.

Describe the solution you'd like
I would like to change or disable the password policy check. A possibility would be a field where I can specify the min. length of a password and some checkboxes were I can require the user to

• use at least a number
• use at least a special character
• use at least a lowercase letter
• use at least an uppercase letter

That way the password policy would be modifiable and could comply with any kind of password requirement policy.

[thannaske]

PS: Okay I just learned about the vars.local.inc.php. But maybe it would be a good idea to comply with NIST policy concerning passwords by default. So e.g. removing the enforced regex or at least reduce it to a length of 8 chars.

[andryyy]

It was like this before, I also think we should revert this.

I just changed it back (not in the repo yet). :)

[Adorfer]

Just for reference:
https://xkcd.com/936/