[Workaround.org] roundcube configuration available ?

Christian Schmidt chris at 2309.net
Wed Mar 4 18:10:04 CET 2009


Thomas Wurdemann wrote:
> Hi Christian... And all other Roundcube users
>
> Just a little hint that you should take your time to upgrade ASAP.
> The html2text file used by the beta allows 'bad guys' to hijack your entire
> server. That actually happened to a friend of mine.
>
> http://www.vupen.com/english/advisories/2008/3418
>
> There are still attacks against my server almost every day. You can check if
> your webserver is also targeted by using 'grep' on your apache logs and
> looking for 'html2text'.
>
> Just a hint for all Roundcube users.
>
> Regards,
>   Thomas
>
>
> -----Original Message-----
> From: workaround-chitchat-bounces at workaround.org
> [mailto:workaround-chitchat-bounces at workaround.org] On Behalf Of Christian
> Schmidt
> Sent: Wednesday, March 04, 2009 9:17 AM
> To: General talk about the contents of workaround.org
> Subject: Re: [Workaround.org] roundcube configuration available ?
>
> J. Bakshi wrote:
>   
>> Hello,
>>
>> Is there already any doc which describes how to configure roundcube 
>> with this multi-domain email system ?
>>
>> Thaks
>> _______________________________________________
>> Workaround-chitchat mailing list
>> Workaround-chitchat at workaround.org
>> http://workaround.org/cgi-bin/mailman/listinfo/workaround-chitchat
>>   
>>     
> Hi,
>
> Its pretty straightforward.
> I  am running still the old version (0.1-beta2) that did not come with the
> installer, so you had to edit the config file by hand. 
> (config/main.inc.php)
> With the installer, it should work the same.
> I have just only enabled IMAP access and that was basically it.
> Log In with full primary email address (aliases wont work) and there you go.
> Works like a charm, as soon as I have time, I will update to the stable
> 0.2 version.
>
> I also have Squirrelmail installed so users can choose - Squirrelmail just
> offers more plugins.
>
> No complications yet with users using both.
>
>
> regards,
> Christian./
> _______________________________________________
> Workaround-chitchat mailing list
> Workaround-chitchat at workaround.org
> http://workaround.org/cgi-bin/mailman/listinfo/workaround-chitchat
>
> _______________________________________________
> Workaround-chitchat mailing list
> Workaround-chitchat at workaround.org
> http://workaround.org/cgi-bin/mailman/listinfo/workaround-chitchat
>   
Thank you for the warning.
havent registered any attacks yet but will update the installation asap.
Also found that having standard web applications (like phpmyadmin, 
squirrel, roundcube etc.) in non standard named folders on secure protocols
helped a lot with regards to total amount and persistence of attacks.
could not register one single attack guessing the right URL and very 
rarely using the secure protocol at all.

(sorry for being slightly OT)
kind regards,
Christian./




More information about the Workaround-chitchat mailing list