disable fallback admin account?

[jjj333-p]

Is there web console for users to be able to change their password and other settings? the one hosted on the http(s) endpoint seems to only respond to the admin login.

Is there any good way to disable the fallback admin account? since it doesnt support 2fa

[jjj333-p]

turns out the admin console does work for users as well, it just wasnt working before. i logged in same way i had been trying to before and it worked now. anywho maybe im the dumb one

[jjj333-p]

yeah aparently it hadn't worked before. is it just being finicky or was i being dumb?

[TruncatedDinoSour]

i have a suspicion, maybe its cuz u fixed the certs ? cuz i couldnt even really load mail.pain.agency before, i had to load config.mail.pain.agency or else it would scream at me about SSL :(

[jjj333-p]

i mean the config.mail.pain.agency is pointing at what mail.pain.agency points at now, and that was managed by caddy. everything else had a cert issue but the website itself shoulda worked. i log in with the fallback admin account the same way

[jjj333-p]

if anyone has any ideas that would be cool. ive seen allusions of it in the docs but i dont know how

[roelWuyts]

I still would like to disable or rename the 'admin' account to limit attacks against a user with that known name - is that possible ?

On the 'settings/authentication/edit' page in the gui I changed 'admin' to a new user and gave it a longer password. I can now log-in with that user, but also still with the previous 'admin' and initially generated passwrd. So I now have two internal users, it seems ...
Any ideas ?

Note: I am a bit wary to go deeper since I also use stalwart-cli, which does not have an option to set the username (so removing admin may not work for that part either?).

[danielcolquitt]

Commenting out the relevant entries in the config.toml seems to disable the fallback admin user for me. At least, I no longer seem to be able to login to the webadmin portal using the fallback credential.