Hi DA Team.
Currently, we can change an email account password from 3 locations:
I think password changes from all 3 locations should be recorded in the logs so they can be reviewed and audited later.
Thank you.
Currently, we can change an email account password from 3 locations:
DirectAdmin > Email Account > Change
- When the password is changed, logs are recorded normally, it's ok.
- /var/log/directadmin/system.log:2026:08:18-12:07:12: Email [email protected] password changed : ip=xxx.xxx.xxx.xxx user={USERNAME}: /CMD\_EMAIL\_POP
Roundcube > Change Password
- No logs are recorded.
- Please enable $config['password_log'] = true; by default. (/roudcube/logs/password.log)
Configuration file: /var/www/webapps/roundcubemail-1.7.2-0ugy/plugins/password/config.inc.php
- /roudcube/logs/password.log [18-Aug-2026 12:17:30 +0700]: <rjhbo6gf> Password changed for user [email protected] (ID: 21) from xxx.xxx.xxx.xxx (X-Forwarded-For: xxx.xxx.xxx.xxx)
https://{URL}:2222/CMD_CHANGE_EMAIL_PASSWORD
- No logs are currently recorded.
- Please improve this by adding logging for password changes.
- I’m not sure whether password changes made via the API are logged.
I think password changes from all 3 locations should be recorded in the logs so they can be reviewed and audited later.
Thank you.
Last edited: