All user can add subdomain of main domain

[Norlan]

Hello,

Sorry for my english but i'm french.

I have a problem with subdomain. I have add a domain (domaine.tld for example) with my admin account, but if I create new user, this new user can use a subdomain with domaine.tld (exemple subdomain.domaine.tld).

I would like the new user can't use my domain for create subdomain.

Do you have solution please ?

[krok]

Im interested in this too. Any?

[imperio]

This is not an error. It was meant to be. This is a convenient way to divide the subdomains by independent accounts. When the subdomains are posted, it reduces the risks from possible break-ins. As far as abuse, then the problem is in the area of responsibility of the server administrator. If someone uses this function, unlawful, these users need to block or remove it completely.

[Felix]

Cross-posting my reply here...

imperio I can understand the need to divide the subdomains but this shouldn't be allowed unconditionally!! For example, if User1 has domain.com and User2 needs to create xxx.domain.com, there SHOULD be a check if User1 allows this subdomain to be created by User2.

This could be implemented with a check box field when creating a new domain, that would allow -if checked- subdomains to be created by different users. Default should be NOT to allow subdomains to be created by different users because to my understanding this could be a huge security issue (scam, phishing, and lots of other threats)

[nobodypb]

I just noticed this too and I'm considering this to be a huge issue.
It isn't always possible to monitor the activities of users in realtime, so there always could be a short period in which a unauthorized user could run a subdomain. Even short periods could cause major security concerns.
For example phishing attacks or to steal cookies shared across subdomains.

I agree with Felix that this has to be addressed and there should be a check if I want to allow this for a particular domain.

[Spheerys]

I'm agree with nobodypb and Felix.

[skurudo]

Ok, I see. We'll discuss this topic again.
I think too, it's no always good.

[SS88]

Ok, I see. We'll discuss this topic again.
I think too, it's no always good.

I currently use this set-up where multiple accounts use sub domains of a single domain; so if this is implemented the need for that checkbox is needed otherwise my current set-up would fail at some point.