MiaB - Security & .htaccess

#1

Hello,

i am new with MiaB and i thinks its a grade solution for my new Mailserver. But how is about security? Can i protect the Adminpanel, OwnCloud an Roundcube with a htaccess? First trys dont work.

I am using Ubuntu Server 14.04 absolute minimal ( VNC clean install )

Greetings from germany

#2

htaccess is an Apache web server thing, but Mail-in-a-Box uses nginx.

In any case, I don’t recommend you modify the box because then you will be on your own when something goes wrong.

#3

IP access restriction to the admin panel would be a very nice (and easy) add-on.

All that needs to be done is a modification of the /etc/nginx/conf.d/local.conf

With something like:

    location /admin/ {
            allow   192.168.1.0/24;
            allow   10.0.1.0/24;
            deny    all;
            proxy_pass http://127.0.0.1:10222/;
            proxy_set_header X-Forwarded-For $remote_addr;
    }
1 Like
#4

If you’re self hosting your MIAB this could also be easily handled with your firewall settings.

1 Like
#5

Does anybody have some instructions on how to achieve this?
I also need to allow access to the Admin panel and webmail only for a certain IP.

#6

I dont believe the above example actually will really work.

#7

It might have worked in 2015 when I posted about it. :joy:

#8

doesn’t proxy_pass http://127.0.0.1:102222 mean, take anything that is at /admin and reverse proxy it back to the localhost address on port 10222 ? Does the admin webpage even run as a separate service on port 10222?

#9

I took a look before replying now and that hasn’t changed.

Take a look at /etc/nginx/conf.d/local.conf

1 Like
#10

Thank you!!!
Worked beautifuly! This should be integrated in the admin interface!!

1 Like
#11

Ahhh yes, Looking at the file I can see what you mean now. Makes me really wonder how the admin page works now.

I can also confirm that adding the “allow” and “deny” statements work.

Not sure this is really needed if you turn on 2FA for admin page but why not, a bit of extra security can’t hurt.

Thanks!

1 Like