Reset User Passwords in Bulk!

I have a client who would like to have the ability to reset user passwords for approximately 150 users every 3 months making use of the same password for all but doing it in bulk.

Is this possible?

Is this wise?

Or is there another way of achieving the same thing?

Basically it is a support site for engineers and my client isn't always informed when an engineer leaves so rather than potentially having the user still able to have access to the site, he would like to reset the passwords every so often, and then notify users directly.

The client does not want users to have the ability to reset their password, or request a password if forgotten.

Your input would be welcome.

Thank you

That is definitely not wise. It is just as easy to loop through the users and give each one his own password.

For each user object, just call $user->generatePassword()

The user object also has a $user->sendEmail($message, $options = array()) API function.
The options can be 'from', 'fromname', 'sender' and 'subject'.

See core/model/modx/moduser.class.php starting around line 767 to see these functions and their defaults.

Imo, it would be better to leave the passwords alone unless you have some reason to believe that they've been stolen.

The alternatives are to use the same password for all users (definitely a bad idea) or email all users a new password that might be intercepted by any server the packet with the email passes through (also a bad idea). Note that the first option includes the second.

Add to that, the incredible annoyance level of forcing users to adapt to a new password every three months and your client has a spectacularly bad idea.

It would be possible to cook up a plugin that would force users to create their own new password. It would still be extremely annoying, but it would be way more secure.

I've never heard of a MODX site where the user's passwords were stolen, and MODX is very resistant to brute-force password hacking, but if a hacker ever did get in via a password hack, the odds are that they would create a back door so changing the passwords at that point wouldn't help.

Most password hacking occurs because a user puts their password on a note near their desk. If you change the password, that user is just going to put up a new note.

Basically it is a support site for engineers and my client isn't always informed when an engineer leaves so rather than potentially having the user still able to have access to the site, he would like to reset the passwords every so often, and then notify users directly.

So it's not a matter of passwords being stolen, it's a matter of ex-employees being able to log in. To be honest, I don't see the advantage of this, since any maliciously-minded ex-employee could still have that three-month (or less) window to do whatever the client is afraid they might do.

This is actually more an issue of their business process. Obviously somebody knows when an engineer leaves, it should be part of the process to send notification to the web manager, or to have some simple means for the HR people to disable a user account. Something with a button that simply sets the disabled to 1 in the database is all it would take. Or their HR software should have some method of adding hooks or plugins, so add a plugin to the "termination" functions to disable the web user account.

Thank you Susan and Bob for your input.

I have been trying to assure the client that it isn't necessarily the best tactic to have the same password across the board.

And I didn't really think doing a bulk update was a clever idea because that would potentially cause other problems/vunerabilities.

So it's not a matter of passwords being stolen, it's a matter of ex-employees being able to log in. To be honest, I don't see the advantage of this, since any maliciously-minded ex-employee could still have that three-month (or less) window to do whatever the client is afraid they might do.

And I'm incline to agree that there should be a process in place to notify when an engineer has moved on, and perhaps that is an area that I need to discuss with the client.

I can assure you from years of experience that trying to twist a website around to compensate for basically bad business practices is a recipe for disaster. And the you get blamed for it.