# Some security related questions **URL:** \ **Category:** Gateway\ **Created:** [December 2, 2009, 3:20pm UTC](https://community.ciphermail.com/t/some-security-related-questions/68 "2009-12-02T15:20:05Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![lst\_hoe021](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@lst\_hoe021](https://community.ciphermail.com/u/lst_hoe021)\ **Post date:** [December 2, 2009, 3:20pm UTC](https://community.ciphermail.com/t/some-security-related-questions/68/1 "2009-12-02T15:20:05Z")
Hello Djigzo uses the "From:" header of the mail to decide which sender certificate to use. As the header is set by the MUA it is prone to spoofing and therefore the decision which certificate to use may be wrong. What is the reason to use the header in this case and not the envelop sender (MAIL FROM) as it is the case for the recipient? The database potentialy hold the private keys used for signing and decryption and should therefore be secured as much as possible. In the standard installation a default password is used and no obvious warning is in the documentation that on should at least prevent remote access to PostgreSQL. This is default for PostgreSQL in some cases but not in all. If one change the password in hibernate.cfg.xml this file is world-readable at least when installed by .deb files. Is it possible to do the following change: Include a warning to protect access with the Djigzo DB-user and maybe a option to use access control based on the OS user which is "djigzo" anyway (local socket) so no handling with passwords is required for the DB. Is there any documentation which ports are used and what they are used for? We have the following ports after std. .deb install: djigzo user 15012 (localhost) --\> no problem 9000 (\*) --\> ?? 10025 (\*) --\> James Mailinput jetty user 8443 (\*) --\> Web-Interface 8282 (\*) --\> ?? So two ports might be unused but open. Many Thanks Andreas