Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.58.7

http-mgmt-source

Globaldeprecatedrestart required

The former way to grant an address access to the monitor — a deprecated directive
in the configuration this is a linehttp-mgmt-sourceinside the block Global
Permission without a level

The line granted an address or subnet access to the web monitor. It has been declared deprecated, and the manual section consists of one sentence: use http-access.

The difference between them is substantial. The former pair of lines could only “let in” and “keep out”; http-access also grades access — monitor, operator, admin, plus the deny-logs qualifier. A one-to-one migration gives everyone allowed full access, and that is almost never what is wanted.

The manual gives no values at all: the section contains only the deprecation mark.

The main trap is migrating the line without choosing a level. The replacement is not written mechanically: for every allowed address you have to decide what it really needs. Most often that is monitor, not admin.
What the Hub does. It does not write it: it uses http-access and explicitly chooses a level for each address. It is worth recognizing the line on sight when analyzing someone else’s configuration migrated from an old version.
Recommended values

Do not translate the value — choose a level:

What it was What it became
http-mgmt-source 10.0.0.5 http-access 10.0.0.5 monitor — if it only needs to look
the same, but a person edits the configuration http-access 10.0.0.5 admin
no-http-mgmt-source 10.0.0.9 http-access 10.0.0.9 none above the other lines

By default nobody is allowed, so an explicit denial is needed only as an exception inside an allowed range.

The fact of deprecation and the replacement with http-access are from the manual (§ 3.3.1.58.7); the section contains nothing more. The migration table and the advice to choose a level are ours.
Example configuration
# this is how it was before
http-mgmt-source 10.0.0.5
# this is how it is written now — with an explicit level
http-access 10.0.0.5 monitor
The lower line replaces the upper one. The level is chosen deliberately: admin equals full access to the node.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends1 mistake▶

Migrating permissions and giving everyone the admin level

our experience

What it costsThe former line knew no levels, and during migration the level is chosen “broader, so that it works”. As a result, reading telemetry gets the right to edit the configuration and run commands.
How to spot itThe list has several admin lines for addresses that only need to look.
How to do it rightGo through the list and lower everything to monitor except those who really edit the configuration.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
http-mgmt-source
Values
values not documented — the section contains only the deprecation mark
Applying
a service restart is required
Queue
will not touch what is already queued
Where to write it
Global
How many times
may be repeated
Everything here comes from the manual, with the section.
Inheritance
No inheritance: the line was written at the root of the file, the Global section. The http-access that replaces it is written there too and is evaluated top to bottom — its line order matters, which was not the case with the former pair.
⇄

Related directives

1 relation

Replaced by

http-accessGlobalCame to replace it and, unlike it, distinguishes access levels. § 3.3.1.58.7

How to check on the node
Find both deprecated lines in the configuration:
grep -rn "http-mgmt-source" /etc/pmta/
Both forms will be found — the allowing one and the denying one. Each is replaced by an http-access line with an explicitly chosen level.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇The group that grants management rightsMembership in the pmta group gives an unprivileged user the right to call the node’s commands and use submission.◇How the node selects a source and combines its settingsA connection falls under all source blocks whose addresses cover it, and they act merged — the narrow one overrides the wide one; named blocks are attached only by direct reference.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Node security
Neighboring settings of the block Global:run-as-roothttp-accesshttp-api-keyhttp-csrf-protectionhttp-redirect-to-httpsAll 108 directives of the block →