{"action":"created","issue":{"url":"https://api.github.com/repos/andryyy/mailcow/issues/399","repository_url":"https://api.github.com/repos/andryyy/mailcow","labels_url":"https://api.github.com/repos/andryyy/mailcow/issues/399/labels{/name}","comments_url":"https://api.github.com/repos/andryyy/mailcow/issues/399/comments","events_url":"https://api.github.com/repos/andryyy/mailcow/issues/399/events","html_url":"https://github.com/andryyy/mailcow/issues/399","id":164843597,"number":399,"title":"Unsecure MySQL Configuration","user":{"login":"wucke13","id":20400405,"avatar_url":"https://avatars.githubusercontent.com/u/20400405?v=3","gravatar_id":"","url":"https://api.github.com/users/wucke13","html_url":"https://github.com/wucke13","followers_url":"https://api.github.com/users/wucke13/followers","following_url":"https://api.github.com/users/wucke13/following{/other_user}","gists_url":"https://api.github.com/users/wucke13/gists{/gist_id}","starred_url":"https://api.github.com/users/wucke13/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wucke13/subscriptions","organizations_url":"https://api.github.com/users/wucke13/orgs","repos_url":"https://api.github.com/users/wucke13/repos","events_url":"https://api.github.com/users/wucke13/events{/privacy}","received_events_url":"https://api.github.com/users/wucke13/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-07-11T13:58:12Z","updated_at":"2016-07-11T14:09:32Z","closed_at":null,"body":"Hey everyone,\r\nI started using mailcow a few days ago and i like it a lot. While editing my MySQL DB, I found two things that confused me: The Setup adds a user \"vmail\", which has no password. I think, its never a good idea to have users without password, even though this user no rights in granted. The second thing is, that \"mailcow\", \"roundcube\" and \"vmail\" user are allowed to connect from any host \"%\". I would suggest to limit the acces to loca system only and/or the domain which is entered in the \"mailcow.config\" during installation. This behaviour occured multiple times installing mailcow 0.13.1 on fresh Debian 8 installations, so I think its reproducable. What do you think about my suggestions?\r\n\r\nBest regards, wucke"},"comment":{"url":"https://api.github.com/repos/andryyy/mailcow/issues/comments/231745357","html_url":"https://github.com/andryyy/mailcow/issues/399#issuecomment-231745357","issue_url":"https://api.github.com/repos/andryyy/mailcow/issues/399","id":231745357,"user":{"login":"andryyy","id":2972950,"avatar_url":"https://avatars.githubusercontent.com/u/2972950?v=3","gravatar_id":"","url":"https://api.github.com/users/andryyy","html_url":"https://github.com/andryyy","followers_url":"https://api.github.com/users/andryyy/followers","following_url":"https://api.github.com/users/andryyy/following{/other_user}","gists_url":"https://api.github.com/users/andryyy/gists{/gist_id}","starred_url":"https://api.github.com/users/andryyy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andryyy/subscriptions","organizations_url":"https://api.github.com/users/andryyy/orgs","repos_url":"https://api.github.com/users/andryyy/repos","events_url":"https://api.github.com/users/andryyy/events{/privacy}","received_events_url":"https://api.github.com/users/andryyy/received_events","type":"User","site_admin":false},"created_at":"2016-07-11T14:09:32Z","updated_at":"2016-07-11T14:09:32Z","body":"There are several system accounts without password, this is a common praxis and not insecure at all. Setting a password and maybe even a shell is much more insecure and can lead to brute force vulnerability.  \n\nThe MySQL host suffix can be changed. I did this in previous versions and only run into more problems because of various and strange MySQL setups.  \nA local installation listens on the loopback interface only, but it may be a good idea to add a hint or something after installing to a remote database.\nWe should also mention that it's best to filter network access on lower levels, too.  \n\n\nAm 11. Juli 2016 um 15:58:13, wucke13 (notifications@github.com(mailto:notifications@github.com)) schrieb:\n\n>  \n>  \n> Hey everyone,\n> I started using mailcow a few days ago and i like it a lot. While editing my MySQL DB, I found two things that confused me: The Setup adds a user \"vmail\", which has no password. I think, its never a good idea to have users without password, even though this user no rights in granted. The second thing is, that \"mailcow\", \"roundcube\" and \"vmail\" user are allowed to connect from any host \"%\". I would suggest to limit the acces to loca system only and/or the domain which is entered in the \"mailcow.config\" during installation. This behaviour occured multiple times installing mailcow 0.13.1 on fresh Debian 8 installations, so I think its reproducable. What do you think about my suggestions?\n>  \n>  \n> Best regards, wucke\n>  \n>  \n> —\n> You are receiving this because you are subscribed to this thread.\n> Reply to this email directly, view it on GitHub(https://github.com/andryyy/mailcow/issues/399), or mute the thread(https://github.com/notifications/unsubscribe/AC1dFhEPm1OZNy41BNGFm0V6KJO1fMnzks5qUkv1gaJpZM4JJZC7).\n>  \n>  \n>  \n>  \n>  \n\n\n"}}
{"actor":{"display_login":"andryyy"}}