Disable Admin View Mail

[percibal]

I'm using Zimbra Open Source to manage multi-domain account, and I have added some user to the "admin" group so they can enter to the Admin Console (7071 port).

My big problem is that this other administrator user CAN view all mail inbox and all the messages for that users. I need that only the other user administrator can add/modify/delete email account but not view client private messages.

How can I disable the "View Mail" Option from the Admin Console (7071)?

Thanks for your time.

[KevinH]

The OSS Edition doesn't allow per-domain admins. You can get this feature in the Network Edition. For the OSS Edition you need to keep a single admin if security is important.

[dotslashroot]

Originally Posted by KevinH

The OSS Edition doesn't allow per-domain admins. You can get this feature in the Network Edition. For the OSS Edition you need to keep a single admin if security is important.

I think having administrative roles is a great idea. I don't like the idea of every admin being able to see every users email. As the main admin *I* don't need to see their email. The other admins definitely do not. If we could assign a role for account creation, password reset, etc without being able to view everyone's email that would be very helpful.

Take care,

Lucas

[schemers]

fine-grained access control is definitely the goal long term. We took a minor step towards that with per-domain admins, and once we get fullblown group support into the server we can then use them for "roles"...

[simonellistonball]

Of course in the mean time, you could write a set of admin scripts, or a separate web app could be used for simple functions... eg. a wrapper for zmprov sp to reset passwords. Would be nice to have full role based controls though.

[pfefferc]

Can you disable it now? I have the Network Version 4.5.

[gmsmith]

Originally Posted by pfefferc

Can you disable it now? I have the Network Version 4.5.

Just remove the "Admnistrator" check box and assign them to "Domain Administrator" and they will not be able to see end user email.

[pfefferc]

But then they won't be able to change some of the admin features.

[gmsmith]

Originally Posted by pfefferc

But then they won't be able to change some of the admin features.

Perhaps...but they either get domain admin/full admin/ or no admin. If you would like to see the behavior modified, submit a request for enhancement in bugzilla.

[pfefferc]

This was suppose to be fixed in Version 4.5.