disable alias login?

[ypong]

This may seem like a strange request considering in the past people have asked for the exact opposite, but, is it possible to disable logins for created aliases?

e.g. I have created a mailbox using account user1@domain.com, and created alias fullnameuser1@domain.com. But I only want the account to be accessed by user1@domain.com, not by fullnameuser@domain.com.

An obvious security issue here is I don't want some script kiddy parked at my imap or smtp ports trying password after password for aliases like postmaster, webmaster, hostmaster etc. With the default Zimbra password lockout for an hour after 10 retries, it means that in a 6 month period (before the password is changed again) they could have tried ~43,000 combinations, and worse still, significantly impacted on the person trying to login to the account proper.

[ypong]

anybody have any suggestions?

[ccelis5215]

Why don't just delete the user alias using the admin UI?

[ypong]

I need the aliases, I just don't want logins to be made available via those aliases. So deleting isn't an appropriate option, unfortunately!

[ccelis5215]

uhmm.... a suggestion to workaround.

1. Delete the alias.
2. Create another account with the name used as the alias.
3. Receive and forward the messages you want to the main account.

Regards.

[bofh]

man thats odd

may someone create a bugreport and post the link (sorry iam lazy do it all the time : )

actually its a security threat not able to dissable
a big one....


ife delete now some text cause i dont want to teach someone how todo but all i can say is thats possible to shutdown entire hositng companys because of this with a minimum on knwolege and resources


i also posted long time ago that they have to fix the return-path in outgoing mail because here you can see the actual username too

sadly no luck with that even there was a discussion about it

[king0770]

See, https://bugzilla.zimbra.com/show_bug.cgi?id=54838

[bofh]

thanks - voted

[ypong]

Thanks, voted too.

[batfastad]

Voted!! I've been wanting to be able to do this for a while.