Demo
Demo

Knowledge base

PMTA knowledge base›Recipe

The monitor as a private control panel

It can change the configuration, not just display it

The task. On a managed node the monitor is needed — for logs, the status page and the message list — but must not become a way for anyone who reaches the port to read accounting, replace the license, edit the configuration or stop sending.

What it is made of:

  • http-mgmt-port — the monitor port, away from ports taken by other software;
  • http-access — the address list with access levels, which is the entire access control model;
  • web-monitor-access — the certificate and the advice not to expose the monitor to the internet.

The parts have different scopes. All of this is node-level: the monitor is one listener per node.

How they interact. This is one decision in three parts, and the weakest one determines the result. A narrow list on the default port is still a service through which anyone with the operator level runs commands; a good certificate with an open list protects the transfer of what should not have been reachable. The essence of the scheme: an http-access line with the operator or admin level is a firewall rule with shell rights.

The main trap is considering the monitor level safe. Without the deny-logs qualifier it serves logs and accounting files — recipient addresses and receiver replies; “just look at the queue” cannot be granted with this level.
What the Hub does. It applies this partially. It sets the monitor port itself (http-mgmt-port); http-access has 127.0.0.1 and ::1 with the admin level and the Hub’s addresses with monitor; the Hub sends commands with the key. The installation’s self-signed certificate is not replaced, and with http-redirect-to-https false polling goes over plain http://.
Recommended values

Three parts and the cost of skipping each:

Part What to set What happens if skipped
http-mgmt-port its own port, checked for conflicts the monitor competes for 8080 with other software
http-access only the needed addresses, a level no higher than needed commands and accounting are available to outsiders
certificate a signed one instead of a self-signed one the node’s authenticity cannot be verified
The port, access levels, the deny-logs qualifier, the certificate and the internet advice come from the manual (§ 3.3.1.58.1, § 3.3.1.58.3, § 5.1). The scheme itself is our hypothesis.
Example configuration
http-mgmt-port 8190
http-access 127.0.0.1 admin
http-access 203.0.113.10 monitor,deny-logs
The address 203.0.113.10 is for illustration; deny-logs cuts off logs and accounting while keeping the monitor pages.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
How to check on the node
Check who the monitor is open to and on which port:
grep -n 'http-mgmt-port\|http-access\|http-redirect-to-https' /etc/pmta/config
ss -ltnp | grep pmtahttp
A line wider than the addresses that need the monitor is an extra entry point; ss shows the address and port the monitor listens on.