47.15. Restricting Access to Modules

Usermin will usually allow all users who can log in to access all of the installed modules. However, this may not be appropriate for your system. You may want some users to just be able to read email and change their passwords, while giving others access to everything. Some of the modules are quite powerful, such as the File Manager and Command Shell, and so should be restricted to people who have FTP or SSH access to your system.

Table 47.1. Read Mail Module Configuration Options
Mail storage format for InboxThis field tells the module what format user mail files are in on your system. The available options are:

Sendmail style single file Each user has a single file containing all his email messages, located either in a directory like /var/spool/mail or in his home directory.

Qmail style directory Each users' mail is stored in a directory in the format used by Qmail—usually called Maildir and located in the users' home directories. Each individual message is in a different file.

MH style directory User email is also stored in a directory, but in the slightly different format used by the MH mail program.

Remote POP3 server Mail is on another server that supports the POP3 protocol. When this mode is selected, users will be prompted to enter a username and password for the POP3 server the first time they log in to the module.

Remote IMAP server Like the previous option, but uses the IMAP protocol instead. When a user first uses this module, they will be prompted to enter an IMAP mailbox name to manage as well.

Sendmail mail file locationThis field and the next one are only used if Sendmail style single file is selected as the mail storage format. You can either select File under home directory to have the module read from a file (set in the next field) in the logged-in user's home directory or enter the full path to a directory containing a mail file of the same name as the user, such as /var/spool/mail.
Sendmail mail file in home directoryWhen the previous field is set to File under home directory, this one specifies the name of that file. Often set to Mailbox, as that is what Qmail uses by default.
Qmail or MH directory locationThese two configuration fields are only used if the mail storage format is set to Qmail style directory or MH style directory. You can either select Subdirectory under home directory to have the module read from a directory (set in the next field) within the user's home directory, or enter the full path to a directory that contains a subdirectory with the same name as the user, such as /maildirs.
Qmail or MH directory in home directoryWhen the previous field is set to Subdirectory under home directory, this one specifies the name of that subdirectory. Set to Maildir by default because that is what Qmail often uses.
Mail subdirectory styleWhen user mail files or directories are located somewhere other than their home directories, this field must be set to match the layout used. On large systems with thousands of users, it often makes sense to group mail files into subdirectories named after the first letter or two of users' names. The options in this menu match various commonly used directory structures. For most systems, however, the default of mail/username is correct.
POP3 or IMAP server nameWhen the mail storage format is set as the Remote POP3 server or Remote IMAP server, this field specifies the hostname of the server to which to connect. You can select localhost to fetch mail with POP3 or IMAP from the same system, although it is more efficient to configure the module to read mail files directly. This may not be possible, however, if you are using the mail storage format—like mbx—that your IMAP and mail servers support but that Usermin does not.
Send mail via connection toWhen Sendmail executable is selected, the module will use the sendmail program to send outgoing email. Even though most mail servers (like Qmail and Postfix) include a fake sendmail program that will work, you can select the second radio button and enter the hostname of another SMTP server to connect to instead. This option is also useful if your system is not running a mail server at all.
Sendmail commandWhen the previous field is set to Sendmail executable, this one must be filled in with the full path to the actual sendmail command it will use.
Default hostname for From: addressesWhen users of this module send email, this field determines what host or domain name is used after the @ in the From: address. If From real hostname is selected, your system's name as reported by the hostname command will be used. If From URL is chosen, the hostname in the URL used to access Usermin (minus any www at the start) will be used. If you select the last option, the domain name entered in the adjacent text box will be used. The last option is generally the best, as it allows you to specify exactly what domain name will be used for outgoing email, such as example.com instead of your server's real hostname like foo.example.com.
Allow editing of From: addressWhen Yes is selected, users will be able to edit the From: address before sending email. Assuming that you have the module set up to automatically use the correct domain name in the address, No should be selected to prevent confusion and stop users from forging email. Of course, there are a hundred other ways that the From: address can be forged in email.
From: address mapping fileThis field can be used to specify a file mapping Usermin login names to From: addresses. It can be very useful if your server hosts multiple email domains and you want different users to use different domain names in their email. If you do enter a file, it must contain one line per user in the format:
Usernameaddress@domain
When sending mail, the module will look for the user's address in the first column and use the matching From: address in the second column.
Allow access to server-side files?By default, the Read Mail module allows users to select a file on the server system to attach to outgoing email. If this presents a security risk on your system, change this field to Neither. Users will still be able to upload files from the PC on which they are running a browser, however.
Maximum total attachments sizeThis field can be used to prevent users from sending excessively large emails by entering a number of bytes that the total unencoded size of all attachments in a message may not exceed.
Minimum mail file size to indexWhen using the Sendmail style single file mail storage format, the module creates indexes of user mail files to speed up their display. Indexing can fail, however, if a file is being frequently changed by another program such as a POP3 server. This field can be used to turn off indexing for mail files smaller than a specified number of bytes. This will have no effect on the module's functionality—it will just make it a little slower.
Use DBM files for indexes?When No is selected for this field (as it is by default), mail indexes generated by the module will be in a simple text format. This works fine, but is slow for very large mail files. Selecting Always will force the generation of binary DBM format indexes, which are much faster and include the Subject: and From: lines of messages, making searching faster, as well. If Only for new indexes is selected, the DBM format will only be used if a text index does not yet exist.
Global address book fileThe Read Mail module lets users create their own personal address book for use when sending email. This field can be used to specify a file of addresses that will be available to all users as well, but not editable by them. The file must contain one email address and real name per line, separated by a single tab. If the filename contains the special code $group, it will be replaced with the name of the user's primary or secondary group (depending on which resulting file actually exists). This allows you to create different global address books for different users on your system.
Allowed folder typesBy default, users can add external files or remote POP3 and IMAP servers as folders. If this bothers you for security reasons, this field can be used to deny access to certain folder types. Any existing user folders of the denied types will be no longer accessible to their owners.

Naturally it is possible to set this up in Usermin, or this section would not have been written. This Webmin module lets you select the Usermin modules that are available to a specific user or members of a group. This is done by creating a list of rules, each of which applies to some user or group or to all users and that either adds or subtracts a list of modules from that user. This allows for quite complex module restriction configurations to be created. For example, you could give the group users access to three modules, and then the user fred (who is a member of users) access to one more without having to list the other three for him explicitly.

To create a module restriction rule, follow these steps:

1.
Click on the Module Restrictions icon on the main page to bring up a list of existing restrictions, an example of which is shown in Figure 47.3.

Figure 47.3. The module restrictions page.


2.
Click on Add a new user or group restriction above or below the list to go to the restriction creation form.

3.
The Applies to field determines which users this restriction affects. You can select Unix user and enter a single username in the field next to it, Members of group and enter a group name, or All users. The latter option is useful for defining the modules that everyone can use, except for users to whom you grant access to more modules in later restriction rules.

4.
In the Modules section is a list of all Usermin modules installed on your system. If Only selected is chosen, then only those modules that you check will be granted access to the user or group. If Add selected is chosen, then the checked modules will be given to the users in addition to any that they have been granted by previous rules. If Remove selected is chosen, the modules that you check will be taken away from the user or group if they have been granted by a previous rule. In most cases, the default of Only selected is all you will need for creating restriction rules.

5.
Hit the Create button to add and activate the restriction. It will immediately apply to all matching users—even those currently logged in.

Once a restriction has been created, you can edit it by clicking on the user or group name in the list on the Module Restrictions page. This will take you to an editing form similar to the one in Figure 47.4. Change the user or group, or list of modules, and hit Save to activate the new selections. Or, use the Delete button to remove the restriction from the list altogether. Because the ordering of restrictions matters, you can move them around in the list with the up and down arrows that appear in the right-most column on the restrictions page. Again, any changes to the list will take effect immediately.

Figure 47.4. Editing a user restriction.


Normally, if no restrictions exist, all users will have access to all modules. This can be changed by clicking on the Available Modules icon on the main page and deselecting those to which nobody should have access. Modules taken away in this way cannot be granted back to specific users on the module restrictions page. Because module restrictions are far more flexible than using the Available Modules page to control which ones are visible, there is no real need to use it.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.16.218.105