Password Policy #

The app defines what passwords must look like: for user accounts and for passwords on public links. It adds a password history, expiration periods with reminders, and a maximum lifetime for public links. It is meant for instances that have to enforce minimum password requirements.

Requirements #

Installation #

In the web interface: open Market from the app menu at the top left, search for "Password Policy", and click Install.

On the command line:

sudo -u www-data php8.4 occ market:install password_policy

market:install downloads, installs, and enables the app. If the app is already present but disabled, this is enough:

sudo -u www-data php8.4 occ app:enable password_policy

For servers without internet access, see Apps and Marketplace.

Configuration #

The rules are under Settings → Admin → Security, section Password and public link expiration policies. Each rule has a checkbox, and most also have a value. Without the check mark, the value has no effect. After installation, no rule is turned on; the Default column shows the preset value. Save applies the settings.

Minimum requirements for accounts and public links #

For lowercase and uppercase letters, numbers, and special characters, the value is a minimum count. The minimum length counts characters, not bytes.

User password policies #

The reminder must come before the expiration: if the reminder period is as long as or longer than the expiration period, the background job sends nothing and writes a warning to the log.

An expired password does not disable the account. At the next login in the browser, owncloud.online asks for a new password before anything else.

The app only knows a password's age if the password was set while the app was enabled. Passwords from before that time therefore only expire after the account has changed its password once. To require a change right away, use occ user:expire-password (see below).

Public link expiration policies #

When one of these rules applies, the public link needs an expiration date: the first rule covers links with a password, the second links without one. owncloud.online rejects a date later than allowed. With separate periods, links with a password may stay valid longer than links without one. These rules apply in addition to the core sharing settings; the stricter rule wins, see Sharing policies.

Set values on the command line #

A check mark is stored as on. When you set a switch with occ, always use on; to turn a rule off, delete the key:

sudo -u www-data php8.4 occ config:app:set password_policy spv_min_chars_checked --value=on
sudo -u www-data php8.4 occ config:app:set password_policy spv_min_chars_value --value=12
sudo -u www-data php8.4 occ config:app:delete password_policy spv_min_chars_checked

Exception: spv_user_password_expiration_notification_value stores the reminder period in seconds, not days. 30 days are 2592000.

Expire an account's password right away #

# alice's password expires now
sudo -u www-data php8.4 occ user:expire-password -u alice

# at a fixed point in time
sudo -u www-data php8.4 occ user:expire-password "2026-12-31 12:00:00 CET" -u alice

# all members of a group
sudo -u www-data php8.4 occ user:expire-password -g sales

The command works only when the rule days until user password expires is turned on. --all covers all accounts that can change their password in owncloud.online.

Usage #

Users notice the policy in three places:

• When they change their password or set a link password, a message explains which rule is not met, for example "The password is too short. At least 12 characters are required."
• Before the password expires, if the reminder is turned on, and after it has expired, a notification with a Change Password button appears. With the default setting of the Notifications app, it also goes out by email to the account's address.
• After expiration, or at the first login, the login leads to a page where the new password is set.

Limitations and notes #

• The rules apply to local accounts, meaning accounts created by administrators, and to guest accounts. Accounts from LDAP or other user backends are excluded; the directory service's rules apply there.
• New requirements for how a password is built apply from the next password change on. Existing passwords stay valid.
• When the app is enabled for the first time on a database that still contains the predecessor app security, it takes over its rules (minimum length, uppercase and lowercase letters, digits, special characters). It never overwrites its own values. The imported rules then also apply to passwords on public links. The import is recorded in the server log.
• Very strict rules often lead to passwords written on paper. NIST SP 800-63B recommends length over character classes and forced changes only when there is reason to suspect a compromise.

Troubleshooting #