#2 - Settings › Security › Hardening: the legacy mail protocols switch - inbuxa-admin

jcoffey-dev commented

2026-09-21 16:26:29 +00:00

Owner

The screen for inbuxa:ProtocolPolicy, the server-wide switch that closes
IMAP, POP3 and ManageSieve (legacy-protocols spec). Reached as
CustomComponent/LegacyProtocols, which the server's schema places under
Settings › Security; a server without that link never shows it.

The selector lists every mail protocol, with what the switch does to
each and on which ports. SMTP and JMAP are shown locked, from the
server's lockedProtocols rather than a list carried here, so unlocking
later needs no admin release (LP-21).
The statement is shown in full before the switch moves and while it is
off, with the listeners that close by name and port, and the note that
firewall rules and port-forwards are the operator's to reconcile
(LP-16, LP-20).
Turning it off takes the typed phrase "turn off legacy mail", matched
exactly. Turning it back on is one click (LP-17).
Listeners that could not be reopened stay listed, with a Try again
(LP-5).
A banner on the Security settings and the dashboard while it is off
(LP-18). It stays silent on a server without the switch.

Visible to whoever may see listeners, changeable by whoever may update
them, matching the permissions the server checks.

Not here yet: the impact panel (LP-15), which needs the server to record
last use per protocol, and the tenant switch (LP-9 to LP-14).

The screen for inbuxa:ProtocolPolicy, the server-wide switch that closes IMAP, POP3 and ManageSieve (legacy-protocols spec). Reached as CustomComponent/LegacyProtocols, which the server's schema places under Settings › Security; a server without that link never shows it. - The selector lists every mail protocol, with what the switch does to each and on which ports. SMTP and JMAP are shown locked, from the server's lockedProtocols rather than a list carried here, so unlocking later needs no admin release (LP-21). - The statement is shown in full before the switch moves and while it is off, with the listeners that close by name and port, and the note that firewall rules and port-forwards are the operator's to reconcile (LP-16, LP-20). - Turning it off takes the typed phrase "turn off legacy mail", matched exactly. Turning it back on is one click (LP-17). - Listeners that could not be reopened stay listed, with a Try again (LP-5). - A banner on the Security settings and the dashboard while it is off (LP-18). It stays silent on a server without the switch. Visible to whoever may see listeners, changeable by whoever may update them, matching the permissions the server checks. Not here yet: the impact panel (LP-15), which needs the server to record last use per protocol, and the tenant switch (LP-9 to LP-14).

jcoffey-dev commented

2026-09-21 16:26:29 +00:00

Author

Owner

assigned to @jcoffey-dev