Re: [RCU] Security issue (possible?) (was: RE: Unknown user in users table, very odd, possible security hole)
On 02/09/2018 09:28 PM, Jorge Bastos wrote:
Well yes, but now i'm thinking, i have the imap server set to be dynamic it's filled with:
mail. + domain.tld
ok this option in Roundcube is grrreeeaaattt, but I think it makes people use my server for webmail! Damn!
How would I tell Roundcube, to connect just to my ip's? I could do this via iptables but is some shared hosting user wants to connect to any imap server he would be blocked
You have a few options to deal with this
default_host username_domain username_domain_forced login_username_filter trusted_host_patterns
How to use them will depend on what you want to achieve and your environment. You can always create a plugin that checks the host before connecting to it.
Alec,
On 02/09/2018 09:28 PM, Jorge Bastos wrote:
Well yes, but now i'm thinking, i have the imap server set to be dynamic it's filled with:
mail. + domain.tld
You have a few options to deal with this
default_host username_domain username_domain_forced login_username_filter trusted_host_patterns
What I want to achieve is, the result of mail . + domain.tld, will result in two ip's (ex: 1.1.1.1 and 2.2.2.2), I want Roundcube to not connect to any other than one of this.
Would this be achievable?
-
A.L.E.C -
Jorge Bastos