Resolved Password reset request was denied

[pleskfiber]

Server operating system version

Ubuntu 20.04.6

Plesk version and microupdate number

18.0.56 #4

Hello everyone!

I'm experiencing a recurring issue with Plesk when trying to send password reset emails to my users. Every time I attempt this, I encounter the following error message, and I'm puzzled about its cause:

Password reset request for email ‘john.doe@example.’com (user ‘john.doe’) was denied: domain ‘example.com can be managed by a different user.

This issue seems to affect nearly all users, whose email accounts are typically in the format <firstname>.<lastname>@example.com. Our Plesk server is hosted under a subdomain (e.g., plesk.example.com), and the main domain example.com is registered to a user within Plesk since it's our company's primary domain.

I have discovered that the password reset function works for the user who have management rights for the example.com domain.

I'm reaching out for insights or suggestions on what might be causing this issue and how to resolve it. Any advice or guidance would be greatly appreciated!

Thank you in advance!

 

[Peter Debik]

This is an expected behavior. When you as a customer use forgot password option while having your email on a domain that has an SMB user that can manage mail on that domain, we explicitly deny your request, because said SMB user can modify the target mail address password and get access to the server as a client/reseller. Solution: Use a valid customer's account o reset a password or ask the Plesk "admin" to do that.

 

[pleskfiber]

Hello Peter,

Thank you for your prompt response.

I've decided to proceed with manually resetting the passwords for the users. I appreciate your assistance in this matter.

 

[mow]

This is an expected behavior. When you as a customer use forgot password option while having your email on a domain that has an SMB user that can manage mail on that domain, we explicitly deny your request, because said SMB user can modify the target mail address password and get access to the server as a client/reseller.

Is this the case for any email that is not in the respective customer's domain itself?

 

[Peter Debik]

I don't get the question. Please re-phrase.

 

[mow]

I don't get the question. Please re-phrase.

Any external email provider is able to read your mail if they choose to, whether they use plesk or not. Why do you think it improves security to just block accounts on the same server in a different subscription? (And blocking all external emails would make the feature rather useless.)

 

[Peter Debik]

I do not know why these decisions were made.