[split] Security Problem detected

[joximu]

raphael Wrote:

Quote:If a domain (or hostname) does not point to the own server then the domain should not be activated - an admin should activate it (or maybe he can allow a reseller to do that, but this depends if the reseller are serious...)

yup, some 'toapprove' status and display it to the resellers;

better: the admin can give the reseller a right to approve such things (or not) - I as a admin won't even trust a "reseller", because the reseller doesn't have the technical knowledge/background what risk a "false" domain can be...
So: maybe a check if the domain is already active *and* a approvement from the reseller with a comment for the reseller that the domain already is active at another hoster...
This would be fine. Of course a mail to the admin :-)

raphael Wrote:Anyways... I'm disabling local DNS look ups

Maybe a good start: the setup routine should not write 127.0.0.1 into resolve.conf - see Post #8 http://www.isp-control.net/forum/securit...ml#pid9592

IMHO postfix does not need a domain lookup - it's enough if the domain is in the "/etc/postfix/ispcp/domains"-file (and mailboxes of course).

/Joximu