Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.58.7

no-http-mgmt-source

Globaldeprecated

The former way to deny an address access to the monitor — a deprecated directive
in the configuration this is a lineno-http-mgmt-sourceinside the block Global
A denial that became a level

The line denied an address or subnet access to the monitor — the negative half of the pair with http-mgmt-source. It has been declared deprecated, and the manual section consists of one sentence: use http-access.

A separate line for denial is no longer needed: denial has become one of four levels — none. It is written with the same directive as permission.

And the order now matters. http-access is evaluated top to bottom until the first match, so the exception is written above the allowing line; the former pair had no such rule.

The main trap is putting the denial below the permission. The former pair did not distinguish order, the new line does: evaluation ends at the first match, and a denial below a broad permission will not work.
What the Hub does. It does not write it: there are no explicit denials in our list — by default nobody is allowed, and it is enough to list the needed addresses.
Recommended values

The replacement is the none level, and it must stand higher:

What it was What it became
no-http-mgmt-source 10.0.0.9 http-access 10.0.0.9 none above the allowing lines
deny everyone except one not needed: the default is already “nobody”

A separate denial is rarely needed — only as an exception inside an allowed range.

The fact of deprecation and the replacement with http-access are from the manual (§ 3.3.1.58.7). The rule about line order is from § 3.3.1.58.3. The migration table is ours.
Example configuration
# this is how it was before
no-http-mgmt-source 10.0.0.9
# this is how it is written now — the exception stands ABOVE the permission
http-access 10.0.0.9 none
http-access 10.0.0.0/24 monitor
The order in the lower example is part of the replacement. Swapped, these two lines will give the denied address access.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Putting the replacement for the denial below the allowing line

§ 3.3.1.58.3

What it costsThe new directive is evaluated top to bottom until the first match. A broad permission above makes the denial unreachable, and the address keeps accessing the monitor.
How to spot itThe none line is there, but the address gets access.
How to do it rightMove the exception above the allowing line.

Migrating a denial that is not required

our experience

What it costsBy default nobody is allowed. Denials “just in case” lengthen the list and create a risk of getting the order wrong.
How to spot itThe list has none lines for addresses that are not in any permission.
How to do it rightRemove them: it is enough not to list the address among the allowed ones.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
no-http-mgmt-source
Values
values not documented — the section contains only the deprecation mark
Applying
reload, no restart needed
Queue
will not touch what is already queued
Where to write it
Global
How many times
may be repeated
Everything here comes from the manual, with the section.
Inheritance
No inheritance: the line was written at the root of the file, the Global section. The http-access that replaces it is written there too, and unlike the former pair, its line order matters.
⇄

Related directives

1 relation

Replaced by

http-accessGlobalCame to replace it: denial is now written with the same line with the none level. § 3.3.1.58.7

How to check on the node
Find both deprecated lines in the configuration:
grep -rn "http-mgmt-source" /etc/pmta/
Both forms will be found — the allowing one and the denying one. The denial is replaced by an http-access line with the none level, placed above the permissions.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇The group that grants management rightsMembership in the pmta group gives an unprivileged user the right to call the node’s commands and use submission.◇How the node selects a source and combines its settingsA connection falls under all source blocks whose addresses cover it, and they act merged — the narrow one overrides the wide one; named blocks are attached only by direct reference.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Node security
Neighboring settings of the block Global:run-as-roothttp-accesshttp-api-keyhttp-csrf-protectionhttp-redirect-to-httpsAll 108 directives of the block →