iRedMail — Changing All Passwords and iRedmail Security

Re: Changing All Passwords and iRedmail Security

null@example.com (ZhangHuangbin) — Tue, 30 Oct 2012 03:35:10 +0000

sami1255 wrote:

- By security I meant, basic secure set up for example; directory listing in apache, disabling apache, php versions on error pages. etc.

All 3 you mentioned are done in iRedMail by default. Also, clients are forced to use IMAPS/POP3S (IMAP/POP3 over STARTTLS), and HTTPS for webmail.

sami1255 wrote:

- I want to change default sql username "root" to something else. What else in iredmail is supposed to be changed ?

Just /var/vmail/backup/*.sh.

sami1255 wrote:

- If my server is compromised because of whatever, changing passwords of all these dbs and config files related to iredmail would be necessary right ? if yes, any guidance would be truly appreciated.

All config files mentioned in file "iRedMail.tips" which generated during iRedMail installation, under iRedMail directory. e.g. /root/iRedMail-0.8.3/iRedMail.tips.

Re: Changing All Passwords and iRedmail Security

null@example.com (sami1255) — Mon, 29 Oct 2012 12:15:26 +0000

- By security I meant, basic secure set up for example; directory listing in apache, disabling apache, php versions on error pages. etc.

- I want to change default sql username "root" to something else. What else in iredmail is supposed to be changed ?

- If my server is compromised because of whatever, changing passwords of all these dbs and config files related to iredmail would be necessary right ? if yes, any guidance would be truly appreciated.

Re: Changing All Passwords and iRedmail Security

null@example.com (ZhangHuangbin) — Mon, 29 Oct 2012 02:43:58 +0000

sami1255 wrote:

- Is it installed in the most optimized way in terms of security ? If No, what more can be done to make it secure further.

Define "security" please.

sami1255 wrote:

- I am in a process of changing all passwords of my server. What passwords do I need to change if I change MySQL root password. Following are the dbs created / associated with iredmail on a fresh ubuntu installation.
amavisd
cluebringer
information_schema
iredadmin
mysql
performance_schema
phpmyadmin
roundcubemail
vmail
Can you please point us to the files where details of the above are stored.

- Backup scripts under /var/vmail/backup/ uses MySQL root password.
- Passwords of SQL user (vmail, vmailadmin, amavisd, roundcube, policyd, cluebringer) were generated randomly, no others knows them except yourself. It's not necessary to change them.

Changing All Passwords and iRedmail Security

null@example.com (sami1255) — Sun, 28 Oct 2012 22:40:30 +0000

==== Required information ====
- iRedMail version: 0.8.3
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Linux/BSD distribution name and version: Ubuntu 12.04
- Related log if you're reporting an issue:
====

I have a few questions related to iRedmail security.

- Is it installed in the most optimized way in terms of security ? If No, what more can be done to make it secure further.

- I am in a process of changing all passwords of my server. What passwords do I need to change if I change MySQL root password. Following are the dbs created / associated with iredmail on a fresh ubuntu installation.

amavisd
cluebringer
information_schema
iredadmin
mysql
performance_schema
phpmyadmin
roundcubemail
vmail

Can you please point us to the files where details of the above are stored.

Will truely appreciate any help.