Knowledge base
A management entrance open only to your own
The monitor is not a public page but a control panel
The task. The web monitor runs on every node whether anyone uses it or not; this setup leaves access to it to the Hub — and nobody else.
What it is made of:
- http-access — a list of addresses with levels, checked top to bottom;
- http-api-key — the key the Hub presents: it grants administrator rights from any address;
- http-redirect-to-https — keeps the key off plain http://;
- http-csrf-protection — prevents changing node state with a GET request.
The parts have different scopes. All four are node-level.
How they interact. The address list and the key are two independent paths to full access: the list does not filter the key holder, so handling the key matters as much as filtering addresses. Transport protection and forged-request protection close the two ways a key leaks or gets misused.
The main trap is turning off https to make polling simpler. The key from http-api-key grants administrator rights from any address, and over http:// it travels in plain text with every request: whoever intercepts it bypasses the address list too.
What the Hub does. It applies half. The access list and the key are in place: 127.0.0.1 and ::1 get admin, the Hub addresses get monitor, and the Hub sends commands with the http-api-key key. But http-redirect-to-https false means the key travels over plain http:// on every poll; http-csrf-protection is not set, so the default applies — the protection is on.
Recommended values
Four lines:
| Line | Default | What to set |
|---|---|---|
| http-access | closed to everyone | admin only for 127.0.0.1, no more than needed for the rest |
| http-api-key | none | a key per node; to rotate, add the new one, then remove the old one |
| http-redirect-to-https | true | leave true |
| http-csrf-protection | true | leave true |
The lines, the order addresses are checked in and the defaults come from the manual (§ 3.3.1.58.2–3.3.1.58.5). The setup itself is our hypothesis.
Example configuration
http-access 127.0.0.1 admin http-access 198.51.100.7 monitor http-api-key 5f6e7e426949e3a5e4ec38e747e71963http-redirect-to-https true
The Hub address is an example; the key comes from the manual’s examples, and a node needs its own.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
How to check on the node
Check whether the monitor accepts plain http://:
curl -s -o /dev/null -w '%{http_code}\n' 'http://127.0.0.1:8080/status?format=json'
A redirect means plain text is closed; 200 means the monitor accepts the key and data without encryption.