Casper Langemeijer wrote:
> Hi All,
>
> A while back I asked how to restrict imap to be used only by certain
> users, Marc Dirix replied and told me to read README.usermap, and use
> the usermap table. I read the readme file and wiki entry, but find it
> very confusing.
Since I wrote that feature I'm probably at fault.
>
> My goal is to deny imap by default, but enable it for specific users.
That's easy but somewhat counterintuitive since that is not what usermap
was designed for.
>
> I tried the following, but this doesn't work:
>
> +----------+----------------+------------------+----------+
> | login | sock_allow | sock_deny | userid |
> +----------+----------------+------------------+----------+
> | ANY | | inet:0.0.0.0:143 | %s |
> | username | inet:0.0.0.0:0 | | username |
> +----------+----------------+------------------+----------+
No that wont work.
>
> Also, this didn't work as expected:
>
> +----------+------------------+------------------+----------+
> | login | sock_allow | sock_deny | userid |
> +----------+------------------+------------------+----------+
> | username | inet:0.0.0.0:110 | inet:0.0.0.0:143 | username |
> +----------+------------------+------------------+----------+
Actually, that *will* work.
> I really like to know exactly how the deny/allow rules are followed, is
> it a single record that is evaluated, are record processed in order? and
> if they are, in what order?
In pseudocode the algorithm is as follows
Given a user who tries to login with 'username' on 'clientsocket':
rows = select sock_allow,sock_deny,userid
from usermap
where login in ('username','ANY')
foreach row in rows:
if match(clientsocket,sock_deny):
deny_access
rowscore = score(clientsocket,sock_allow)
if rowscore > bestscore:
bestscore = rowscore; bestrow = row
if bestrow:
if bestrow['login'] == 'ANY':
real_login=expand(username, bestrow['userid'])
else:
real_login=bestrow['userid']
>From this you can deduce that setting up the policy you want, you
shouldn't use sock_deny, but rather map ANY user to a non-existent userid.
login sock_allow sock_deny userid
---------------------------------------------------------------
ANY inet:0.0.0.0:0 nosuchusergoawaynow
ANY inet:0.0.0.0:110
username inet:0.0.0.0:143
this way, users will be mapped to a non-existant user by default,
denying them access. The second and third records are more specific so
when anyone tries to login on port 110, access is granted. But only
'username' is allowed to use port 143.
hope that helps.
--
________________________________________________________________
Paul Stevens paul at nfg.nl
NET FACILITIES GROUP GPG/PGP: 1024D/11F8CD31
The Netherlands________________________________http://www.nfg.nl
_______________________________________________
DBmail mailing list
[email protected]
https://mailman.fastxs.nl/mailman/listinfo/dbmail
