Admin able to access mailboxes without password

donsony

This is a major concern while providing support where an admin needs to have access to view a client's mailbox. The feature is available in cPanel. This is very important

nqnoc

I do not agree. For me the ability to say to my clients that not even me as access to their emails, is a benefit.
Also for other security concerns and RGPD where I think this feature helps in terms of privacy.

JohnB

nqnoc But if you have access to the server you can absolutely access them. If thats a security or compliance issue the customer shouldn't be using any shared hosting email.

+1 as its too much trouble getting a password from the user that they will forget or type wrong.

josedieguez

nqnoc
If you are the server admin, you have access to the mail files, mail logs, and can change the mail passwords.

You can even backup the old mail password, change it, check the mail, and revert the password...

This is a good feature request, for support purposes, if someone don't trust his hosting with the mail data, should use Google, so Google can read and use all his mail data for ads personalization and analytics.

donsony

nqnoc That's just what you think because the UI is not there. The emails are stored in plain text and viewable using a plain text editor via SSH. So there is not specific security concerns here.
At the same time, having this UI sometimes help in providing remote support scenarios

Adam

This is a common feature request, we will make it a platform setting in the near future.

Rich

Adam Might it be possible to make that user account specify? I.e. junior support roles can't, estate owners and admins can?

JohnB

Rich +1 on this part.

george

Rich +1 on this part!

nqnoc

I understand all points of views. As a suggestion, ok I would do the server admin webmail direct access, but only for the server admin and not the domain/account admin. The ability of the boss or co-workers be able to login other people email box without knowledge or consent, is not a good idea.

JohnB

Really its simple as this: Can user access emails via SSH? If yes, allow mailbox access without password. If no, don't allow...

Its a bad precedent and is very cyberpanely (ie garbage) to imply security restrictions in the UI but in reality there is a workaround.