pmgquarantineproxy(8)

☰

NAME

pmgquarantineproxy - Proxmox Mail Gateway User Quarantine Daemon

SYNOPSIS

pmgquarantineproxy <COMMAND> [ARGS] [OPTIONS]

pmgquarantineproxy help [OPTIONS]

Get help about specified command.

--extra-args <array>: Shows help for a specific command
--verbose <boolean>: Verbose output format.

pmgquarantineproxy restart

Restart the daemon (or start if not running).

pmgquarantineproxy start [OPTIONS]

Start the daemon.

--debug <boolean> (default = 0): Debug mode - stay in foreground

pmgquarantineproxy status

Get daemon status.

pmgquarantineproxy stop

Stop the daemon.

DESCRIPTION

This daemon serves only the user quarantine, on a port of its own. It exists so that the quarantine can be reached by users without also exposing the management API, which pmgproxy serves on the same socket as the quarantine.

Like pmgproxy it runs as user www-data with very limited permissions, and forwards operations that need more to the local pmgdaemon.

Every request for a path outside the quarantine is refused before authentication happens. A stolen or forged quarantine ticket therefore cannot reach node, configuration or access management endpoints through this daemon. The management interface itself is not served here at all; the bare host redirects to /quarantine.

The daemon is not enabled after installation. Enable it deliberately, once the port, the certificate and the access control below are configured:

systemctl enable --now pmgquarantineproxy

Port and certificate

Both are read from the spamquar section of /etc/pmg/pmg.conf, not from /etc/default/pmgquarantineproxy:

listenport: The port this daemon binds to. Defaults to 8007.
listencert: The certificate it serves, containing both certificate and key. Defaults to /etc/pmg/pmg-api.pem. Use a separate certificate when the public quarantine hostname differs from the management hostname.

Note that spamquar also has a port option. That one is unrelated to this daemon: it only shapes the links in the daily spam report. Set it as well when users reach the quarantine on a different port than listenport, for example behind a reverse proxy. With protocol https and port 443, no port is added to those links.

Restricting the management interface

Splitting the quarantine off is only useful if the management interface is then actually restricted. Set LISTEN_IP in /etc/default/pmgproxy to an internal address, and restart pmgproxy:

systemctl restart pmgproxy.service

Host based Access Control

The same “apache2”-like access control lists as for pmgproxy are read from /etc/default/pmgquarantineproxy, using ALLOW_FROM, DENY_FROM and POLICY. LISTEN_IP, CIPHERS, CIPHERSUITES, HONOR_CIPHER_ORDER, DHPARAMS, DISABLE_TLS_1_2, DISABLE_TLS_1_3 and COMPRESSION behave as they do for pmgproxy; see the pmgproxy manual page for details.

This daemon is meant to be reachable from untrusted networks. Keep the access control here as tight as the deployment allows.

Copyright and Disclaimer

This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License along with this program. If not, see https://www.gnu.org/licenses/