John1 writes:
BTW, your reply came through as a text file attachment rather than plain text in the body of the email.
That's what happens when your email software is from a convicted monopolist that refuses to properly implement a 10-year old Internet standard for digitally-signed mail.
Right, OK. Ummm, then maybe I am suggesting an unusal approach to addressing what I am sure has to be a fairly common security concern? My aim is to prevent employees, unless specifically authorised, from connecting on their home PC to our publically accessible mail server using the user id and password on their office PC. Surely this can't be a "third or fourth person, over the last ~4 years requirement"? Maybe there is a better way of achieving the same aim without involving the client IP?
The most common solution that tends to address these kinds of issues is to simply make encryption mandatory. That usually solves a whole host of issues at once.
Could it be that people with my requirement are using a different authentication layer? Is it just the Courier authdaemond that is unaware of the IP address?
Correct. Authentication is a fairly security-sensitive function. As such, and by design, it's a separate process that only communicates with other processes using an internal, narrowly-defined protocol. Its only input is the login ID and a password.
Is there another common authentication layer that I could
use instead that would allow me to test the client IP in conjunction with
user id & password?
Nope. At this time, there is no convenient button to push, in order to get this done.
pgpLBbonHXvD3.pgp
Description: PGP signature
------------------------------------------------------------------------- Check out the new SourceForge.net Marketplace. It's the best place to buy or sell services for just about anything Open Source. http://sourceforge.net/services/buy/index.php
_______________________________________________ Courier-imap mailing list [email protected] Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-imap
