DirectAdmin Email Forwarder Manager

⚠️ PROOF OF CONCEPT - This application was generated by AI and has not been audited for security or production use.

A PHP web application for managing email forwarders through the DirectAdmin API on MXroute servers.

Features

• Server Selection: Choose from 21 available MXroute servers at login
• Secure Login: Authenticate with your DirectAdmin username and password
• Persistent Sessions: Stay logged in until logout or session timeout (1 hour)
• Domain Selection: Choose from all domains in your DirectAdmin account
• Email Forwarder Management:
  • View all email forwarders for a selected domain
  • Add new email forwarders
  • Edit existing forwarders
  • Delete forwarders with confirmation

Requirements

• PHP 7.0 or higher
• cURL extension enabled
• Web server (Apache, Nginx, etc.)

Installation

1. Upload all files to your web server directory
2. Ensure your web server has write permissions for session management
3. Access the application through your web browser

File Structure

daforwarders/
├── config.php              # Configuration and session management
├── DirectAdminAPI.php       # DirectAdmin API wrapper class
├── index.php               # Login page
├── dashboard.php           # Main dashboard with domain selection
├── manage_forwarder.php    # Add/edit/delete forwarders
└── README.md              # This documentation

Usage

1. Login:
   • Select your MXroute server from the dropdown list
   • Enter your DirectAdmin username and password
2. Select Domain: Choose a domain from the dropdown on the dashboard
3. Manage Forwarders:
   • View existing forwarders in the table
   • Click "Add New Forwarder" to create a new one
   • Click "Edit" to modify an existing forwarder
   • Click "Delete" to remove a forwarder (with confirmation)
4. Logout: Click the logout button in the header to end your session

Security Features

• Session-based authentication with automatic timeout
• Auth token expiry independent of session timeout
• CSRF protection through session validation
• Input validation and sanitization
• SQL injection prevention (no direct database queries)
• XSS prevention through proper HTML escaping

⚠️ Security Notice: This proof of concept stores passwords in session data. For production use, consider:

• Using DirectAdmin Login Keys (see below)
• Implementing a secure server-side cache (Redis/Memcached) for credentials
• Using OAuth or similar token-based authentication if available

Enhanced Security with DirectAdmin Login Keys

For production use, we strongly recommend using DirectAdmin Login Keys instead of your main account password:

1. Create a Login Key in DirectAdmin:

   • Login to your DirectAdmin control panel
   • Navigate to Account Manager → Login Keys
   • Create a new key with API access permissions
   • Restrict the key to only the commands needed:
     • CMD_API_SHOW_USER_CONFIG
     • CMD_API_SHOW_DOMAINS
     • CMD_API_EMAIL_FORWARDERS

2. Use the Login Key:

   • Use your regular username when logging in
   • Use the Login Key value as the password
   • This provides better security by not exposing your main account password

3. Benefits:

   • Limit IP access to specific addresses
   • Set expiration dates
   • Restrict available commands
   • Easy revocation without changing main password

Configuration

The application supports the following MXroute servers:

• eagle.mxlogin.com
• pixel.mxrouting.net
• taylor.mxrouting.net
• sunfire.mxrouting.net
• blizzard.mxrouting.net
• longhorn.mxrouting.net
• safari.mxrouting.net
• lucy.mxrouting.net
• arrow.mxrouting.net (default)
• echo.mxrouting.net
• london.mxroute.com
• shadow.mxrouting.net
• moose.mxrouting.net
• tuesday.mxrouting.net
• monday.mxrouting.net
• wednesday.mxrouting.net
• redbull.mxrouting.net
• witcher.mxrouting.net
• heracles.mxrouting.net
• everest.mxrouting.net
• glacier.mxrouting.net

You can modify config.php to:

• Add or remove servers from the list
• Change the default server
• Adjust port number (default: 2222)
• Change protocol (default: https)
• Modify session timeout (default: 1 hour)

API Endpoints Used

The application uses the following DirectAdmin API commands:

• CMD_API_SHOW_USER_CONFIG - Validate user credentials
• CMD_API_SHOW_DOMAINS - Get list of domains
• CMD_API_EMAIL_FORWARDERS - Manage email forwarders

Troubleshooting

• Login fails: Verify your DirectAdmin credentials and ensure the server is accessible
• Domains not loading: Check if your account has proper permissions to view domains
• Forwarders not saving: Ensure your account has email management permissions
• Session timeout: Sessions expire after 1 hour of inactivity for security

Support

This application is designed specifically for MXroute customers. Select your server from the dropdown when logging in. For DirectAdmin-related issues, contact MXroute support.