Posts by kassah

    I'd love to see a engine plugin to use for instance the Linode API to add domains to their secondary DNS servers, setting the i-MSCP as the master:


    https://www.linode.com/api/dns/domain.create
    https://www.linode.com/api/dns/domain.delete
    https://www.linode.com/api/dns/domain.update


    This would optimally add and remove the domains as the were added to i-MSCP so that linode DNS could retrieve them from i-MSCP and serve as backup DNS. etc.


    I'm sure there are dozens of similar services out there. The same model could be used for that.


    I know the Plek panel (while ago ;) ) and there were only options to add a list and users.


    Everything else can be managed with the mailman admin panel i think.


    (only setting up a new list and jump to the admin panel would be great too because everything can be configured inside the admin interface of mailman)


    Yep, it's the only reason I still use Plesk... Some of my accounts require list-servs. So those remain on Plesk.


    However Plesk has the same issue, they actually provide a copy of mailman that is fully patched to their needs, such that they are providing security updates, etc. themselves. i-MSCP devs don't have the bandwidth to do that unfortunately. Thus the desire to use distro provided packages.

    One by One. I assign this Thread to kassash. Maybe he can answer


    It is definitally a desire of mine.


    There are a couple of complications that will keep it from being in the mainline codebase for a while...
    - Mailman 3 is almost out, which significantly changes a lot of things (their almost out is like... 2-3 years)
    - Mailman 2 has some quirks that keep it from being easy to implement. (i.e. two domains cannot use the same list name)
    - There are some controls inside mailman 2 itself that need to be patched out (i.e. remove the users control over them)


    So, we're kinda stuck in a catch 22. More than likely if I do it right away. It will be a module. Nuxwin has already added some hooks into i-MSCP for that purpose.


    hallo, what do you guys think about making the SSL option per domain (package option)?Thereby giving resellers/admins control over who can enable SSL. I think this might be a very nice way to option the new SSL feature you guys worked so hard on, but am not sure where to start with implementing this change...


    Would probably be good, and to hide it entirely when it's disabled.

    If we made it so that all hosted accts have a shared group. We could add a "Match" line to match just the hosting groups, and then add "AuthorizedKeysFile" line.


    This would force all hosting ssh accounts to use imscp loaded ssh keys, while leaving the rest of the accts on the server (i.e. admins, etc) to use ~/.ssh/authorized_hosts and ~/.ssh/authorized_hosts2


    For instance (just a sample):

    Code
    1. Match GROUP imscp_customer
    2. AuthorizedKeysFile /etc/ssh/imscp_keys/$u/authorized_keys
    3. AllowAgentForwarding no
    4. AllowTcpForwarding no
    5. PasswordAuthentication no
    6. GSSAPIAuthentication no
    7. HostbasedAuthentication no
    8. PubkeyAuthentication yes
    9. X11Forwarding no


    I don´t see there "more" security by redirect the Login to a other page.


    I agree, not really a security bit. Although it could stop some browser SSL name mismatch errors. i.e. what would happen if control panel ssl cert has a Common Name of "admin.slashdot.org" and it gets loaded via url "https://80.80.80.80/" instead of the admin https url.

    Patching openssh is still a no go. If ssh has added support for it in vanilla openssh-server, or another stock ssh server that is available on debian it might be worth a look.


    Personally, I prefer ssh keys. You can load multiple public keys to an acct. They are not passwords, so you are not giving away passwords.


    Keys are also flexible, it is possible to change the shell based on which key is passed. Indefero git hosting does something like this in order to limit ssh users to only git operations and the like.


    Might be something to explore there.