Chapter 34. Managing expiring password notifications

Procedure

1. Update the epn.conf configuration file to set the options for the EPN tool to notify users of upcoming password expiration.

   # vi /etc/ipa/epn.conf

2. Update the notify_ttls as required. The default is to notify users whose passwords are expiring in 28, 14, 7, 3, and 1 day(s).

   notify_ttls = 28, 14, 7, 3, 1

3. Configure your SMTP server and port:

   smtp_server = localhost
   smtp_port = 25

4. Specify the email address from which the email expiration notification is sent. Any unsuccessfully delivered emails are returned to this address.

   mail_from =admin-email@example.com

5. Save the /etc/ipa/epn.conf file.

6. Run the EPN tool in dry-run mode to generate a list of the users to whom the password expiration email notification would be sent if you run the tool without the --dry-run option.

   ipa-epn --dry-run
   [
       {
        "uid": "user5",
        "cn": "user 5",
        "krbpasswordexpiration": "2020-04-17 15:51:53",
        "mail": "['user5@ipa.test']"
       }
   ]
   [
       {
        "uid": "user6",
        "cn": "user 6",
        "krbpasswordexpiration": "2020-12-17 15:51:53",
        "mail": "['user5@ipa.test']"
        }
   ]
   The IPA-EPN command was successful

   Note

   If the list of users returned is very large and you run the tool without the --dry-run option, this might cause an issue with your email server.

7. Run the EPN tool without the --dry-run option to send expiration emails to the list of all the users returned when you ran the EPN tool in dry-run mode:

   ipa-epn
   [
     {
        "uid": "user5",
        "cn": "user 5",
        "krbpasswordexpiration": "2020-10-01 15:51:53",
        "mail": "['user5@ipa.test']"
     }
   ]
   [
     {
       "uid": "user6",
       "cn": "user 6",
       "krbpasswordexpiration": "2020-12-17 15:51:53",
       "mail": "['user5@ipa.test']"
     }
   ]
   The IPA-EPN command was successful

8. You can add EPN to any monitoring system and invoke it with the --from-nbdays and --to-nbdays options to determine how many users passwords are going to expire within a specific time frame:

   # ipa-epn --from-nbdays 8 --to-nbdays 12

   Note

   If you invoke the EPN tool with the --from-nbdays and --to-nbdays options, it is automatically executed in dry-run mode.

Procedure

1. Open the EPN message template:

   # vi /etc/ipa/epn/expire_msg.template

2. Update the template text as required.

   Hi {{ fullname }},
   
   Your password will expire on {{ expiration }}.
   
   Please change it as soon as possible.

   You can use the following variables in the template.

   • User ID: uid
   • Full name: fullname
   • First name: first
   • Last name: last
   • Password expiration date: expiration
3. Save the message template file.