Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.58.3

http-access

Globalcriticalrestart requiredset by the Hub

Who gets into the web monitor and with what rights
in the configuration this is a linehttp-access noneinside the block Global
Whom to let into the node’s management console

This line sets which addresses the monitor is open to and what they are allowed to do there. There are four levels: none — nobody; monitor — read-only; operator — plus viewing the configuration and running commands; admin — plus editing the configuration. deny-logs can be added to monitor to close access to the logs.

The monitor is a management console, not a viewing panel. From it you edit the configuration, run commands and delete messages from the queue. admin-level access equals access to the node.

The line repeats and is evaluated top to bottom — the first match wins. So a wide line above a narrow one overrides it: http-access 0/0 monitor at the top of the file makes everything below it meaningless.

Closed to everyone by default. The monitor listens on its port and answers 403 until an address is allowed here. The manual separately warns that the management interface should not be exposed to the internet.

The main trap is treating this list as protection while handing out the key. The manual says it plainly (§ 8.2, § 8.3): a valid key in the header cancels the address restrictions and works from any address. The list is the first line of defense; the key bypasses it rather than adding to it.
What the Hub does. It writes it — three lines or more: 127.0.0.1 admin and ::1 admin for the node itself, then monitor for every known Hub address. The Hub deliberately gives its own address read-only access and performs administrative actions with the key.

The reason is written down in the code: the Hub’s address is often a shared network exit, and admin on it would go to every machine behind that same exit. If the Hub’s address is unknown, a comment is written instead of the line, and access stays local only.

Recommended values

Choose the level by what exactly the person you let in needs:

Level What it gives
none nothing; an explicit deny higher up the list
monitor reading state and queues
monitor,deny-logs the same without access to logs
operator plus reading the configuration and commands
admin plus editing the configuration

The order of lines matters: narrow ones above wide ones.

The four levels, the deny-logs qualifier, top-to-bottom evaluation and the none default come from the manual (§ 3.3.1.58.3). That the key cancels the address restriction comes from there too (§ 8.2, § 8.3). The breakdown of our access scheme is based on the Hub’s code.
Example configuration
# narrow lines above wide ones: evaluation goes top to bottom
http-mgmt-port 1000
http-access 127.0.0.1 admin
http-access 10.0.0.5 monitorhttp-access 0/0 none
The last line is optional — the default is none anyway — but it makes the intent explicit for whoever reads the file after you.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends3 mistakes▶

Putting a wide line above a narrow one

§ 3.3.1.58.3

What it costsEvaluation goes top to bottom until the first match. 0/0 monitor at the top of the list makes all following lines unreachable, including explicit denies.
How to spot itAn address gets a different level from the one written for it further down.
How to do it rightReorder: the narrowest lines first, the wide ones last.

Closing the monitor by address while handing out the key

§ 8.2

What it costsThe key cancels the address restriction and works from anywhere. For anyone who has the key, the list stops restricting anything.
How to spot itThe monitor log shows successful requests from addresses that are not on the list.
How to do it rightTreat the key as equal to full access and protect it the same way as the node itself; the address list is the line of defense for those without a key.

Giving admin level to a shared network exit

our experience

What it costsThe level goes not to one person but to every machine behind that same exit — the whole office or the whole subnet.
How to spot itThe list has admin on a gateway address or a wide subnet.
How to do it rightGive the address read-only access and perform administrative actions with the key — that is what the Hub does.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
http-access CIDR { monitor[,deny-logs] | operator | admin | none }
Values
a CIDR and one of the levels none, monitor[,deny-logs], operator, admin
Default
none § 3.3.1.58.3
Applying
a service restart is required
Queue
will not touch what is already queued
Where to write it
Global
How many times
may be repeated
Everything here comes from the manual, with the section.
Inheritance
There is no inheritance: the lines are written at the root of the file, the Global section. The list is shared by the whole node: it has no split by interface or by API — the monitor, the configuration API and the command API are all evaluated against one and the same list.
⇄

Related directives

3 relations

Can be replaced by

http-api-keyGlobalTwo ways to let someone in, and the second is stronger than the first: a valid key cancels the address restriction. § 3.3.1.58.5

Affects

The node's main configuration fileThe operator level and above opens reading the configuration through the API — that is, the whole file with all the secrets in it. § 3.1

Applies to

Restrict who can reach the node at allOne of the five steps of narrowing access to the node; the other four are about mail submission. § 1.6.1

Referenced from

http-mgmt-portGlobalThe port opens the door, the list decides whom to let through it. § 3.3.1.58.3http-redirect-to-httpsGlobalOne decides whom to let in, the other whether they come encrypted. inferencehttp-mgmt-sourceGlobalCame to replace it and, unlike it, distinguishes access levels. § 3.3.1.58.7no-http-mgmt-sourceGlobalCame to replace it: denial is now written with the same line with the none level. § 3.3.1.58.7http-enable-api-configGlobalWhat was created can be read by access level, but changed only with a key. inferencelog-fileGlobalThe monitor’s refusals by address are written to a log of the same family — only to its own file, pmtahttp.log. § 3.3.1.58.3

How to check on the node
Check it from the address in question — a 403 answer is the result:
curl -s -o /dev/null -w '%{http_code}\n' http://NODE:1000/status
200 — the address is allowed, 403 — it is not. The engine writes parsing errors of the line itself to the monitor log /var/log/pmta/pmtahttp.log; the address the refusal came from lands there too — the manual advises looking exactly there.
◇

What else to read

3 articles

◇The vendor's analytics — and what leaves the node for itA paid service that receives the node’s accounting data and returns analytics, a health score and a spam trap report; it is enabled by scope and stays off until its block exists.◇Exposing metrics over SNMPThe node can expose its metrics over SNMP — a second way of monitoring besides the web monitor.◇What the node tells about itself and through which channelsSeven observation surfaces: the web monitor, the console in four formats, the log, accounting, accounting search, metrics and export to external analytics.

In the Hub
Managed at
Infrastructure → Node parameters
Value
The Hub picks it itself — pace, warm-up stage, metrics
Cost of a mistake
dangerous: effects outlast a rollback
Scenarios
Node security · Collect telemetry
Priority
critical
Neighboring settings of the block Global:http-api-keyrun-as-roothttp-csrf-protectionhttp-redirect-to-httpslog-file-world-readableAll 108 directives of the block →