Request to Enable Logging for Email Password Changes from All Methods

[mean]

Hi DA Team.

Currently, we can change an email account password from 3 locations:

DirectAdmin > Email Account > Change​

• When the password is changed, logs are recorded normally, it's ok.
• /var/log/directadmin/system.log:2026:08:18-12:07:12: Email [email protected] password changed : ip=xxx.xxx.xxx.xxx user={USERNAME}: /CMD\_EMAIL\_POP

Roundcube > Change Password​

• No logs are recorded.
  
  
• Please enable $config['password_log'] = true; by default. (/roudcube/logs/password.log)
  Configuration file: /var/www/webapps/roundcubemail-1.7.2-0ugy/plugins/password/config.inc.php
  
  
• /roudcube/logs/password.log [18-Aug-2026 12:17:30 +0700]: <rjhbo6gf> Password changed for user [email protected] (ID: 21) from xxx.xxx.xxx.xxx (X-Forwarded-For: xxx.xxx.xxx.xxx)

https://{URL}:2222/CMD_CHANGE_EMAIL_PASSWORD​

• No logs are currently recorded.
• Please improve this by adding logging for password changes.

Directadmin API /CMD_API_CHANGE_EMAIL_PASSWORD , CMD_EMAIL_POP, CMD_API_EMAIL_POP

• I’m not sure whether password changes made via the API are logged.

I think password changes from all 3 locations should be recorded in the logs so they can be reviewed and audited later.

Thank you.

 

[zEitEr]

Hello,

Even if DirectAdmin does not put a record about a changed password in logs, all requests are still logged. You might find POST requests to the mentioned endpoints. Those are potential clues of a changed password. This is said in case you need a quick solution. Otherwise you might contact DA developers directly.

I think password changes from all 3 locations should be recorded in the logs so they can be reviewed and audited later.