Issues with MailEnable

isaak
Posts: 476
Joined: Sat Nov 11, 2006 12:10 am

Issues with MailEnable

Postby isaak » Sat Jun 23, 2018 4:54 pm

Hello, I have taken the time to write this issues with MailEnable and also wrote the steps to be able to reproduce them.


1) Skin selection. When setting a fixed skin under ME management console, in some cases webmail will not show the correct selected skin.

. Open MMC console
. Go to Servers > localhost > Services and Connectors
. Select Webmail. In the right pane double click a hostname
. Set BASE, SKIN and LANGUAGE. Click OK.
. Access Webmail using the affected hostname above
. Input username and password
. CHANGE LANGUAGE to a different one set above (!important!)
. Click Login button.

Result: Changing the default language into a different one causes ME to load a different skin other than the default (presumptively the first skin sorted by alphabetical order). If the default language is not changed, the selected skin under MMC management will load correctly.


2) Checkbox in Webmail (select/unselect). When marking some emails to remove or to report them as spam and executing the action, the selected emails disappear (as intended) and once they are removed from inbox or any other folder, a checkbox remain active in an unselected message (most of the time legit) causing the user to accidentally delete or report that message as spam.

. Login to Webmail
. Select various messages with checkbox
. Delete them or report them as spam (!important!)

Result: The selected messages will disappear and 1 message from the remaining messages will automatically have assigned a checkbox, changing from "unselected" to "selected". The way it should work is that no message should remain selected after performing an action (deleting or reporting) because the users could continue selecting other messages to remove or report as spam, and the message that was automatically assigned with the checkbox will be included unintentionally into that second group. This issue builds a LOOP since there will always be a checkbox assignment to an unselected message after an action is performed by the user.


3) Restriction by Country. It works partially. When using a VPN service such as PureVPN, all the services become available.

. Open MMC console
. Open a postoffice properties
. Select "Auth Policies" tab
. Select "Only connections from the countries selected..."
. Select a country other than the one you are located
. Click "Ok"
. Get an PureVPN account
. Follow the L2TP procedure in the link below
. Select a country not selected in the procedure above
. Connect to the VPN service (!important!)
. Authenticate through your iOS using IMAP

Result: You will notice that the VPN will establish a connection and this will assign an IP address of the country you selected. ME will allow the connection through IMAP (haven't tested other protocolos) although the source connection comes from a country that is not allowed in the Auth Policies.
https://support.purevpn.com/how-to-setup-purevpn-manually-on-iphone-l2tp


4) Two Factor Authentication. When setting challenge to "Prompt for New Country" the system will not keep the setting. Instead, it will change it to "Prompt for New IP Address".

. Open MMC console
. Open a mailbox properties
. Select "Auth Policies" tab
. Set Challenge to "Prompt for New Country"
. Click "Ok"
. Open again the mailbox properties
. Select "Auth Policies" tab
. Verify the Challenge setting

Result: The Challenge setting "Prompt for New Country" is not saved, instead a different challenge is loaded "Prompt for New IP Address". When setting this through Webmail, it seems to be correctly saved but once verified through MMC console and clicking OK then the correct setting is lost again. The problem with this is that although "Prompt for New Country" is set, Webmail requests a code when a New IP address is detected regardless of the country.

!IMPORTANT! (suggestion)
In addition to this last bug, I thing this AUTH POLICIES tab could be improved in the following scenario: Under "Authentication restriction by country" select "Only connections from the countries selected below can authenticate" and then select 1 authorized country (typically where you are located at the moment). Then, under "Two Factor Settings" select the Challenge "Prompt for New Country".

Now the suggestion is that if the user authenticates from a country that is not in the authorized list, the 2FA will request the user to enter a code generated by any TOTP client. If the user successfully logins into his mailbox with the generated code then the new country where the user is located should be automatically added into the authorized list or under the "Only connections from the countries selected below can authenticate" list in the MMC console. This is a good suggestion because the way it works right now is: if a user has USA for example as the only 1 authorized country and in 2FA the Challenge is set to "Prompt for New Country", then the user travels for example to Canada, Webmail will detect the new country and ask the user for the 2FA code but once the user gives all the correct information to login, the country restriction setting (only USA) will block him to login. It should not be that way since the user provided the correct 2FA in the new country (plus the fact that the setting of the user under 2FA is "Prompt for New Country").


Regards,

Maranda
Posts: 19
Joined: Mon Dec 11, 2017 8:10 pm

Re: Issues with MailEnable

Postby Maranda » Sun Jun 24, 2018 7:32 am

I encountered 1) month's ago, and that at least you can patch by yourself see this post: http://www.mailenable.com/forum/viewtopic.php?f=14&t=42146&p=112325#p112325

Regards.

Who is online

Users browsing this forum: No registered users and 2 guests