Demo
Demo

Knowledge base

PMTA knowledge base›Mechanism§ 5.1

What protects the web monitor and what that protection is not

web monitor access control
An address list instead of accounts

There are three protections, and they fail in different ways, so they are worth keeping apart.

The first is an address list, and by default it is empty. A fresh node answers a browser with a refusal, not with data; the manual warns about this separately, because the refusal looks like a malfunction and is not one. The level is assigned to a range with the http-access line: monitor, operator or admin, with the deny-logs qualifier for logs.

There is not a single account. A level is given to an address range, and everyone coming from it is one and the same anonymous visitor. A range with the admin level can read the configuration, replace the license, download accounting files and run a command — and no trace of who did it will remain. Levels narrow what can be done but do not make what happens traceable.

The second is encryption, and the certificate for it is generated at installation, self-signed. Browsers warn about it; it is fixed not with a configuration line but by replacing the /var/lib/pmta/webmon.pem file and restarting the monitor. The vendor names one specific consequence: Internet Explorer on Windows works very slowly with such a certificate.

The third is not a protection but an instruction: the monitor must be reachable only on the local network and not from the internet. The vendor’s wording is a warning, not advice, and it is justified: through the monitor you can see the configuration file, the license, logs, accounting files, the list of local addresses and the command execution page.

The main trap is reading chapter 5 as a description of a single flat permission list. It says not a word about access levels, the deny-logs qualifier or the fact that a key overrides the address restriction — that is in § 3.3.1.58.3 and chapter 8. Someone who has read only chapter 5 will be sure that a list entry means “let them look.”
What the Hub does. It writes the list itself: admin for the node’s local addresses, monitor for its own. It performs administrative actions with a key, because the Hub’s own external address is not permanent. Hence a consequence worth keeping in mind: what protects the node from our key is not the address list but how the key is stored.

🔴 And this is worth checking on the fleet. On a fleet node the monitor port turned out to be reachable from an arbitrary machine on the internet — the 403 refusal came, but it came after the connection was established, and in the refusal body the engine named the configuration path, the log path and the line that grants full access. This is the only surface of the node where the error is not visible and can be exploited remotely.

Recommended values

The mechanism has no values of its own: they are set by three directives.

What Set by Default
port http-mgmt-port 8080
who is let in http-access no one
whether encryption is mandatory http-redirect-to-https true since version 5.0

The certificate is not a directive but a file, /var/lib/pmta/webmon.pem.

The default refusal, the self-signed certificate, how to replace it, the Internet Explorer case and the warning about the internet come from the manual (§ 5.1). Access levels and the key overriding the restriction come from § 3.3.1.58.3 and chapter 8; chapter 5 does not mention them. That the fleet node’s port is reachable from outside is our own check.
Example configuration
# three protections in one place: the port, the list, mandatory encryption
http-mgmt-port 1000
http-access 127.0.0.1 adminhttp-access 10.0.0.5 monitor
http-redirect-to-https true
There is no fourth line for the certificate, and there cannot be: it is a file. Replacing the certificate is a separate operation with a monitor restart.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends3 mistakes▶

Taking a fresh node's refusal for a malfunction

§ 5.1

What it costsBy default nobody is allowed, and the monitor responds with a refusal. People look for a fault in the service, even though it works as designed.
How to spot itThe monitor listens on the port and responds 403 to everyone without exception.
How to do it rightAdd your address to http-access and restart the monitor.

Relying on the address list instead of a firewall

our experience

What it costsThe connection reaches the port, and the refusal comes from the application — together with file paths and a ready-made line for full access. On top of that, any glitch in list parsing immediately means an open node.
How to spot itThe monitor port responds from an arbitrary machine on the internet.
How to do it rightClose the port at the network level, leaving the Hub’s addresses; the list inside is the second line of defense.

Expecting access levels to make actions traceable

§ 5.1

What it costsA level is given to an address range, not to a person. Who exactly replaced the license or stopped a queue does not follow from the log.
How to spot itThe action happened, but the person responsible cannot be found.
How to do it rightEnable http-log-requests and give different applications different keys — then at least you can see whose key was used.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Inheritance
The mechanism has no inheritance — the directives that enable it are inherited, and all of them are written at the root of the file, in the Global section. There is one monitor on a node, and its settings cannot be split by interface or by visitor.
⇄

Related entries

4 relations

Depends on

Who took the portThe monitor has no standard port, and 8080 on a machine is often taken by something else. § 4.2.1

Works together with

Restrict who can reach the node at allNarrowing access to the monitor is one of the recipe’s five steps; the rest are about mail submission. inference

Affects

ConsoleThe command execution page — the very reason access levels have to be distinguished. § 5.2ConfigurationThe page shows the whole configuration file, together with all the secrets in it. § 5.6

Referenced from

Monitor response formatsThe same setting at another level. § 5.1The monitor's home pageAccess to the screen is decided by rights and addresses set at the node level. § 5.1LicenseAccess to the screen is decided by rights and addresses set at the node level. § 5.1Connect the node to the vendor's consoleThe mechanism the command works with. § 6.3.33How the node decides whether to let an HTTP request inThe three HTTP interfaces have the same admission rule as the monitor itself: they answer on one port. § 8.2Exposing metrics over SNMPA related mechanism: they work together. inference

How to check on the node
The first question is not “who is on the list” but “who can reach the port at all.” Check from outside, from a machine outside the trusted network:
curl -s -o /dev/null -w '%{http_code}\n' --connect-timeout 5 http://NODE:1000/status
A 403 response means the list works — and that the port is reachable from the internet. The right response here is a timeout: the connection should not reach the port. The address list is the second line of defense, not the first.
◇

What else to read

3 articles

◇How the node decides whether to let an HTTP request inTwo ways to identify yourself — an access level by address and a key; the key is stronger and works from any address.◇The activation key is a prerequisite for installation, not a step after itWithout an activation key from SparkPost support the engine neither installs nor runs, and the license tier sets the outbound connection ceiling: on Standard everything above 200 is ignored.◇Cloud restrictionsClouds restrict outbound mail on port 25 until you ask them to lift the limit, and mailbox providers treat their address ranges with suspicion.

In the Hub
Cost of a mistake
reversible: harms only while it is set
Scenarios
Prepare a node for sending · Node security