Abstract

The UM web interface, IMAP4 interface, and Telephone User Interface (TUI) now support password encryption. If UM Fix Update 4.2.0.150 is installed and password encryption is configured, the encrypted password information is stored in an internal database table and is used instead of the unencrypted password for mailboxes.


Content

The web interface, IMAP4 interface, and Telephone User Interface (TUI) now support password encryption. The password a user enters is encrypted if there is a PasswordEncryption=yes setting under the [Passwords] section in the IMC_MessageCenter.ini configuration file.

If UM Fix Update 4.2.0.150 is installed and password encryption is configured, the encrypted password information is stored in an internal database table and is used instead of the unencrypted password for mailboxes.

Passwords entered by an administrator will continue to be unencrypted, and in some circumstances, such passwords are retrievable by an administrator. Users should be forced to change their passwords as soon as they log on after having their passwords reset by an administrator. This can be achieved by the administrator setting the password_change_date to a date in the past.

When passwords are validated, a check is always made against both encrypted and unencrypted passwords, regardless of the setting of the PasswordEncryption variable. Consequently, if password encryption is turned off, users with encrypted passwords do not need to have their passwords reset.

Password encryption and password history are supported the first time a user logs in as well as for regular password entry / password change.

If the user ID is changed (for example by using the moveuser, makeshared, makealias, or moveprofile commands) the encrypted password associated with the original user ID is retained for use with the modified user ID.

Note: Encrypted password support is not at present compatible with the UniquePwds=yes setting for shared numbers with sub-mailboxes.