SO MANY SECURITY ISSUES!! Sentora needs serious updates!

[fearworks]

I would like to see your report.

Each service may need addressed according to the concerns of your report.
For instance after installing Sentora I configured Postfix to use StartTLS for handling mail. Likewise configuring proFTPD itself to be more secure would likely correct your concerns.

We can address those issues.


Something that I think needs some attention:

FTP account passwords are shown in plain text in Sentora panel. "Show Passwords" and "Hide Passwords" are useless, as they are always shown.

I would rather Sentora treat FTP accounts the same as client/mailbox accounts where passwords are never visible, but can be updated.

The show/hide password issue is a simple Javascript issue. If you download the latest version of the module.zpm file for the FTP Management module from the Github master repository, it should work:

https://raw.githubusercontent.com/sentor...module.zpm

I did tweak two lines for it to work how I wanted on my servers:

Code:

$('#btn_sh').innerHTML = 'Hide passwords';
$('#btn_sh').innerHTML = 'Show passwords';

changed to:

Code:

$('#btn_sh').html('Hide passwords');
$('#btn_sh').html('Show passwords');

Give it a try and see if it now works.

Keith.