<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body><div style="font-family:Arial;">That's going to be the case on all versions of Cyrus - admins have quite a lot of "root"-like power, and the @domain limitation is quite lightweight as you can see!<br></div>
<div style="font-family:Arial;"><br></div>
<div style="font-family:Arial;">I would recommend running a completely separate Cyrus instance per zone of control if this is a concern - while it would be nice to lock down all the ways in which admins are powerful, realistically it's a ton of work.<br></div>
<div style="font-family:Arial;"><br></div>
<div style="font-family:Arial;">(the usual "pull requests welcome" of course - I wouldn't object to making boundaries around domain admins solid, but I don't have the dev cycles to throw at it)<br></div>
<div style="font-family:Arial;"><br></div>
<div style="font-family:Arial;">Bron.<br></div>
<div><br></div>
<div><br></div>
<div>On Mon, 25 Sep 2017, at 18:19, Marco wrote:<br></div>
<blockquote type="cite"><div>Hello,<br></div>
<div><br></div>
<div> I run Cyrus-IMAPD 2.4.17 with many virtual domains:<br></div>
<div><br></div>
<div>virtdomains: userid<br></div>
<div><br></div>
<div>I configured a domain administrator:<br></div>
<div><br></div>
<div>admins: <a href="mailto:admin@example.com">admin@example.com</a><br></div>
<div><br></div>
<div>With this account I can LIST all accounts in example.com domain only, as<br></div>
<div>expected.<br></div>
<div><br></div>
<div>Let suppose the Cyrus-IMAPD server stores also accounts for other<br></div>
<div>domains, such as example2.com domain.<br></div>
<div><br></div>
<div>Well, I see that I can SASL PLAIN login using <a href="mailto:admin@example.com">admin@example.com</a> on<br></div>
<div>example2.com accounts too, if I know their names. I can't understand why<br></div>
<div>this could happen. It seems a security issue.<br></div>
<div><br></div>
<div><br></div>
<div>Is there a way to prevent this issue without modifying ACL on all<br></div>
<div>accounts?<br></div>
<div><br></div>
<div>Thank you<br></div>
<div>Marco<br></div>
<div>----<br></div>
<div>Cyrus Home Page: <a href="http://www.cyrusimap.org/">http://www.cyrusimap.org/</a><br></div>
<div>List Archives/Info: <a href="http://lists.andrew.cmu.edu/pipermail/info-cyrus/">http://lists.andrew.cmu.edu/pipermail/info-cyrus/</a><br></div>
<div>To Unsubscribe:<br></div>
<div><a href="https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus">https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus</a><br></div>
</blockquote><div style="font-family:Arial;"><br></div>
<div id="sig56629417"><div class="signature">--<br></div>
<div class="signature"> Bron Gondwana, CEO, FastMail Pty Ltd<br></div>
<div class="signature"> brong@fastmailteam.com<br></div>
<div class="signature"><br></div>
</div>
<div style="font-family:Arial;"><br></div>
</body>
</html>