Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.58.1

http-mgmt-port

Globalrestart requiredset by the Hub

Web monitor port
in the configuration this is a linehttp-mgmt-port 8080inside the block Global
The door behind which node management lies

The web monitor is a separate program, pmtahttpd, and this line sets the port it listens on. The default is 8080; such a service has no standard port, so something else on the same machine often takes it.

The value 0 does not bring up the monitor at all. This is the only way to switch the management interface off completely — not “closed to everyone” but not started.

All three of the engine’s HTTP interfaces live on this same port: the monitor itself, the configuration APIs (§ 8.2, § 8.3) and the command API (§ 8.4). One port — so one decision about its reachability for all of them.

The port answers both a plain request and a TLS handshake. We verified this on a fleet node: the monitor looks at the first bytes of the connection. It has no separate “port for https.”

The main trap is assuming the port is closed because “nobody knows it.” The port is open to anyone who can reach it; the refusal comes one level up, from http-access. And that refusal is talkative: in the 403 body the engine reveals the path to the configuration file, the path to its log and a ready-made http-access <your address> admin line. Verified on a fleet node.
What the Hub does. It writes it — setting 1000 instead of the vendor’s 8080. All fleet telemetry (NodePoller, PmtaMonitor) and all commands to the node (PmtaCommander) go through this port.

The port is stored in node_engines.mgmt_port and substituted into the template. After applying the configuration the Hub restarts the monitor — PmtaConfigApplier::restartMonitor — otherwise a port change will not take effect and the monitoring dashboard will go blank with a healthy engine.

Recommended values

The port is chosen so that it does not face the internet:

Value When
1000 our choice for the fleet
8080 (default) often taken by another application
0 the management interface is not needed at all

The number by itself protects nothing. The restriction is in http-access and in the node’s firewall.

The 8080 default, the value 0 and the restart requirement come from the manual (§ 3.3.1.58.1). That the port answers both a plain request and a handshake, and that the 403 body reveals paths, are our own checks on a fleet node.
Example configuration
# the node's management interface: the port + who is admitted to it
http-mgmt-port 1000http-access 127.0.0.1 admin
http-access 10.0.0.5 monitor
The first line without the following ones is useless: the port is open but answers 403 to everyone. The port and the access list are written together.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends3 mistakes▶

Changing the port and reloading the configuration

§ 3.3.1.58.1

What it costsThe monitor reads its settings when it starts. pmta reload does not touch it, and it keeps listening on the old port with the new value in the file.
How to spot itThe file has one port, while ss -lntp shows another.
How to do it rightRestart the web monitor: systemctl restart pmtahttp where it is a unit, or through pmtawatch.

Exposing the monitor to the internet on a non-standard port

our experience

What it costsThe port is found by scanning within hours. The 403 refusal body itself hints at the configuration path, the log path and the line that has to be added there for full access.
How to spot itThe monitor log shows attempts from unfamiliar addresses.
How to do it rightClose the port with the node’s firewall and leave access only to the Hub’s addresses.

Setting 0 to “close the monitor” and losing control

§ 3.3.1.58.1

What it costsZero does not close the monitor, it does not start it. Along with it the command API and the configuration API disappear — and with them all control of the node from outside.
How to spot itThe node is running, telemetry is empty, commands do not go through.
How to do it rightRestrict access with the http-access list, not by switching the port off.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
http-mgmt-port <port>
Values
a TCP port number; 0 — do not start the monitor
Default
8080 § 3.3.1.58.1
Applying
a service restart is required
Queue
will not touch what is already queued
Where to write it
Global
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
There is no inheritance: the line is written at the root of the file, in the Global section, and applies to the whole node. There is one monitor; it cannot be brought up on a second port.
⇄

Related directives

2 relations

Conflicts with

Reloading settings versus restarting the serviceThe only monitor directive whose restart the manual mentions directly; in practice all of its settings require a restart. § 3.3.1.58.1

Works together with

http-accessGlobalThe port opens the door, the list decides whom to let through it. § 3.3.1.58.3

Referenced from

http-redirect-to-httpsGlobalOne of the settings of the very interface that listens on this port. § 3.3.1.58.2http-csrf-protectionGlobalOne of the settings of the very interface that listens on this port. § 3.3.1.58.4http-api-keyGlobalAll three HTTP interfaces that the key opens listen on this port. § 8.4http-strict-transport-security-max-ageGlobalOne of the settings of the very interface that listens on this port. § 3.3.1.58.6http-tls-allow-sslv3GlobalOne of the settings of the very interface that listens on this port. § 3.3.1.58.8http-tls-allow-tlsv1GlobalOne of the settings of the very interface that listens on this port. § 3.3.1.58.9

How to check on the node
We check that the monitor is listening and answering; use your own port:
ss -lntp | grep ':1000'
Empty output means the monitor did not come up: either the port is 0, or pmtahttpd is not running, or the port is taken. A 403 response to curl with the port listening means the monitor works and the address is not allowed in http-access.
◇

What else to read

3 articles

◇What the node tells about itself and through which channelsSeven observation surfaces: the web monitor, the console in four formats, the log, accounting, accounting search, metrics and export to external analytics.◇Two inbound report processors and what to do with themBounces by message and complaints are parsed by two identically structured blocks; each has its own address list and its own pair of decisions about the message’s fate.◇Five ways for a queue to hand off a messageA queue does not have to use SMTP: it can write to a file, run a program, call over HTTP or discard.

In the Hub
Managed at
Infrastructure → Node parameters
Value
The Hub picks it itself — pace, warm-up stage, metrics
Cost of a mistake
disruptive: applying it interrupts the node
Scenarios
Collect telemetry
Neighboring settings of the block Global:track-outbound-perf-statstrack-inbound-perf-statsdummy-smtp-update-statshttp-default-max-itemshttp-default-sort-orderAll 108 directives of the block →