How To Detect Weak Mail Passwords On Your ISPConfig 3 Server

By Nedim Hadzimahmutovic <[email protected]>

This is a short tutorial on how to find out weak password for your mail users. This will save you you a huge headache since spammers will find out mail account with weak password and send spam email as that user which will result in your mail server being blacklisted.eval(ez_write_tag([[580,400],’howtoforge_com-medrectangle-3′,’ezslot_2′,121,’0′,’0′]));


Export mail users from database to local file

Use command below to export users and their passwords to local file.

# mysql -u root -p dbispconfig

Run this once logged in mysql.

mysql> SELECT email,password FROM dbispconfig.mail_user INTO OUTFILE ‘/tmp/sql.txt’ FIELDS TERMINATED BY ‘:’ ESCAPED BY ‘\\’ ENCLOSED BY ” LINES TERMINATED BY ‘\r\n’;

A file containing usernames and passwords is created in /tmp/sql.txt


Use “John the Ripper” to find out weak passwords

Install the program.eval(ez_write_tag([[580,400],’howtoforge_com-medrectangle-4′,’ezslot_1′,108,’0′,’0′]));

# apt-get install john

Load the exported mail user list from /tmp/sql.txt file.

# john -single /tmp/sql.txt

John will show you the cracked passwords. To see the cracked passwords later on run command below.

# john –show /tmp/sql.txt

To find out simple numeric passwords like 123456 run john in incremental mode.

# john –incremental=Digits /tmp/sql.txt

To find out simple alphanumeric passwords like abc123 use the wordlist mode as shown below.

# john –wordlist=/usr/share/john/password.lst /tmp/sql.txt

To see more examples run:

# zless /usr/share/doc/john/EXAMPLES.gz

When you finish, do not forget to remove the sql.txt file!!

# rm /tmp/sql.txt

About the Author

Leave a Reply