On Sun, Sep 24, 2000 at 04:11:53PM -0600, Sean Reifschneider wrote:
> vmailmgr DOES work with RPMs. However, the CGI web interface that comes with
> it is incomplete to the point of not functioning. Add undocumented...
I don't suppose you read the "vmailmgr-cgi.html" file, located both in
the doc directory of the package and on the web site?
> I
> ended up having to dig through the code, and then modify the CGIs so I could
> even use them...
I don't recall you ever posting any of the problems you've had to the
mailing list. Or asking me, for that matter.
> Virtual domains are set up under a user account. Domain
> administration is done by providing that user's system password to the
> CGI. Naughty...
As opposed to what? The user's account can be set up to have /bin/false
as its login, so that the only thing that an attacker could do is play
around with that one account's mailboxes. If it's the idea of sending
passwords around on the Internet, vpopmail does the same thing, AFAIK.
Use HTTPS if you're worried.
> No system access is
> required for virtual domains or their maintenance.
This is misleading. Aside from creating and deleting virtual domains,
vmailmgr can be managed completely through the web, either through the
(admitedly limited) CGIs, or through oMail (using PHP), or through a
custom PHP or Python (or C++) CGI interface if desired.
> Also, vpopmail
> has a nifty option where you can set up virtual IPs for each domain and
> vpopmail will resolve "user myname" correctly instead of requiring
> "user [EMAIL PROTECTED]"...
Both vpopmail and vmailmgr have this feature, and have had it from the
start.
> >virtual users
> vmailmgr: virtual domains are hosted under a particular user id.
> Uses system password for CGI-access to virtual domain.
In addition, each virtual user has a password, and that virtual user can
manage their own account (change forwards, modify autoresponse, etc.)
without going through the administrator.
> vpopmail: all virtuals stored under a single user ID/directory.
Which to some has the implication that breaking that one user ID breaks
all virtual user email on the system.
> >quota support
> I believe both support quotas but I haven't used them.
Yes. With vmailmgr, per-domain support is done through filesystem
quotas, since each domain is a seperate user, and per-account is through
an optional (included) add-on program.
> >html-mail-administration
> vmailmgr: Non-functional demo CGIs provided, which require some time to
> install and get working.
> vpopmail: QMailAdmin is full-featured and works well. A separate package
> from the main vpopmail distribution.
See above, this is misleading and rapidly changing.
> I tried looking at getting sqwebmail to use the vmailmgr authentication
> scheme, but didn't have any luck in the limited time I had to muck around
> with it.
When I first looked at it, sqwebmail used compiled-in authentication
modules, and included the code for vpopmail and not vmailmgr. I've
heard, but haven't had time to investigate, that sqwebmail now uses the
same auth modules as courier-imap does, in which case it should work
fine with the vmailmgr auth module.
--
Bruce Guenter <[EMAIL PROTECTED]> http://em.ca/~bruceg/
PGP signature
