We are happy to announce that Vesta is back under active development as of 25 February 2024. We are working on v1 candidate and expect to engage more with the community over the coming months. We are committed to open source, and we encourage contributors to help us build the future of Vesta.
All user can add subdomain of main domain
All user can add subdomain of main domain
Hello,
Sorry for my english but i'm french.
I have a problem with subdomain. I have add a domain (domaine.tld for example) with my admin account, but if I create new user, this new user can use a subdomain with domaine.tld (exemple subdomain.domaine.tld).
I would like the new user can't use my domain for create subdomain.
Do you have solution please ?
Sorry for my english but i'm french.
I have a problem with subdomain. I have add a domain (domaine.tld for example) with my admin account, but if I create new user, this new user can use a subdomain with domaine.tld (exemple subdomain.domaine.tld).
I would like the new user can't use my domain for create subdomain.
Do you have solution please ?
Re: All user can add subdomain of main domain
Im interested in this too. Any?
Re: All user can add subdomain of main domain
This is not an error. It was meant to be. This is a convenient way to divide the subdomains by independent accounts. When the subdomains are posted, it reduces the risks from possible break-ins. As far as abuse, then the problem is in the area of responsibility of the server administrator. If someone uses this function, unlawful, these users need to block or remove it completely.
Re: All user can add subdomain of main domain
Cross-posting my reply here...
imperio I can understand the need to divide the subdomains but this shouldn't be allowed unconditionally!! For example, if User1 has domain.com and User2 needs to create xxx.domain.com, there SHOULD be a check if User1 allows this subdomain to be created by User2.
This could be implemented with a check box field when creating a new domain, that would allow -if checked- subdomains to be created by different users. Default should be NOT to allow subdomains to be created by different users because to my understanding this could be a huge security issue (scam, phishing, and lots of other threats)
imperio I can understand the need to divide the subdomains but this shouldn't be allowed unconditionally!! For example, if User1 has domain.com and User2 needs to create xxx.domain.com, there SHOULD be a check if User1 allows this subdomain to be created by User2.
This could be implemented with a check box field when creating a new domain, that would allow -if checked- subdomains to be created by different users. Default should be NOT to allow subdomains to be created by different users because to my understanding this could be a huge security issue (scam, phishing, and lots of other threats)
Re: All user can add subdomain of main domain
I just noticed this too and I'm considering this to be a huge issue.
It isn't always possible to monitor the activities of users in realtime, so there always could be a short period in which a unauthorized user could run a subdomain. Even short periods could cause major security concerns.
For example phishing attacks or to steal cookies shared across subdomains.
I agree with Felix that this has to be addressed and there should be a check if I want to allow this for a particular domain.
It isn't always possible to monitor the activities of users in realtime, so there always could be a short period in which a unauthorized user could run a subdomain. Even short periods could cause major security concerns.
For example phishing attacks or to steal cookies shared across subdomains.
I agree with Felix that this has to be addressed and there should be a check if I want to allow this for a particular domain.
Re: All user can add subdomain of main domain
I'm agree with nobodypb and Felix.
Re: All user can add subdomain of main domain
Ok, I see. We'll discuss this topic again.
I think too, it's no always good.
I think too, it's no always good.
Re: All user can add subdomain of main domain
I currently use this set-up where multiple accounts use sub domains of a single domain; so if this is implemented the need for that checkbox is needed otherwise my current set-up would fail at some point.skurudo wrote:Ok, I see. We'll discuss this topic again.
I think too, it's no always good.