With dovecot, it's possible to verify passwords via LDAP with authentication binds.

I am looking for a web interface solution which features following:

The administrator creates all user accounts in LDAP and sets a preliminary password for each account. Each user should be able to change their own account password over a website with access to LDAP. So, only the password is writeable by the respective user and nothing else. The same password is used to access mail server via SMTP and IMAP and login into the website.

Note: For security reasons, it should not require a web server running on the same server as the mail server (as e.g. PostfixAdmin does).

  • 1
    What is used at SMTP side? If Postfix, maybe PostfixAdmin (a web tool) could be used. – Izzy Jul 20 '18 at 11:16
  • @Izzy Thanks for the feedback. Currently, I am using postfix on my old server. Postfixadmin seemed to me to be too bloated. But, if I am able to limit the capabilities only to changing passwords, I might give it a try. – David Sardari Jul 20 '18 at 18:37
  • Unfortunately, postfixadmin cannot be used as it requires the webserver to be running on the same server as the mailserver, which I don't want to do due to security reasons. – David Sardari Jul 20 '18 at 20:01
  • 1
    I wasn't aware of that limitation. To avoid others tapping into the same trap, I took the freedom to add that to your question. Sorry my suggestion didn't fit. – Izzy Jul 20 '18 at 21:00

You can use web2ldap for this. Being the author I'm biased of course.

Its input forms can be customized with very simple HTML templates. And you can add new entries based on simple LDIF templates, e.g. specifying parent DN and object classes.

Furthermore you can construct bookmarks for directly pointing a LDAP user to password change form.

P.S.: Are you already running an LDAP server and loaded it with data? Which schema for mail accounts are you using?

  • Thanks :). I am still considering my options. Basically, I want to store the password in an encrypted form on a server that is queried by Dovecot and replies with a success or fail message. Dovecot never gets to see the correct passwords. – David Sardari Jul 20 '18 at 18:56
  • So you don't have a running LDAP server yet and you're starting from scratch? – Michael Ströder Jul 20 '18 at 21:58
  • Yes. Everything is still in the open. I am currently using Postfix and Dovecot together with a relay server, provided by my webhoster. Now, I would like to setup everything myself. – David Sardari Jul 21 '18 at 10:18
  • I'm using my Æ-DIR also for maintaining mail accounts with aliases and simple mail groups. There are config examples for postfix and dovecot in the git repo. – Michael Ströder Jul 21 '18 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.