Allow administrator to put custom score ?

[bougatoyta]

Hi,

I believe that in the past, administrator could create custom score in PMG

I just tried to increase the score of a rule and I got a permission denied because I was not in root access.

How can I allow administrator to make change of score ?

Regards

 

[Stoiko Ivanov]

Adding new scores was always restricted to root@pam as far as I can see.
Since many of those configurations are restricted to root@pam I'm not sure if we want to change it for this particular case

What's your use-case exactly?

Thanks!

 

[bougatoyta]

Adding new scores was always restricted to root@pam as far as I can see.
Since many of those configurations are restricted to root@pam I'm not sure if we want to change it for this particular case

What's your use-case exactly?

Thanks!

Root access is reserved for the admin team, and our client as access to the mail filter as an admin and want to be able to modify custom score

 

[Stoiko Ivanov]

Root access is reserved for the admin team, and our client as access to the mail filter as an admin and want to be able to modify custom score

Hm - I'm still a bit hesitant - the changes to the custom scores are effective globally for all mails - so depending on how your setup works - one client would be able to change the spam-detection for all clients...

OTOH - how often do they need to adapt spamassassin scores - if its very often I'd rather check why these adaptations are necessary and if they really have the desired effect...

I hope this helps!

 

[bougatoyta]

Hm - I'm still a bit hesitant - the changes to the custom scores are effective globally for all mails - so depending on how your setup works - one client would be able to change the spam-detection for all clients...

OTOH - how often do they need to adapt spamassassin scores - if its very often I'd rather check why these adaptations are necessary and if they really have the desired effect...

I hope this helps!

We work in a 1 client = 1 PMG instance, this is why they have admin access, they are autonomous on the management of the spam filter but for security reason and compliance we cannot give them the root password, so in our case give the access to custom score change is not a problem.

But I totally understand why, it could be useful to have a role that give such power to a user whitout it being the root account, first to have a proper logging of action in place (for example if user 1 and 2 have a role similar to superuser, but their own account, we know who is at fault when something messy happen)