Hi Paul,

> >>
> >> From this you can deduce that setting up the policy you want, you
> >> shouldn't use sock_deny, but rather map ANY user to a non-existent
> userid.
> >>
> >> login      sock_allow        sock_deny      userid
> >> ---------------------------------------------------------------
> >> ANY        inet:0.0.0.0:0                   nosuchusergoawaynow
> >> ANY        inet:0.0.0.0:110
> >> username   inet:0.0.0.0:143
> >>
> >> this way, users will be mapped to a non-existant user by default,
> >> denying them access. The second and third records are more specific
> so
> >> when anyone tries to login on port 110, access is granted. But only
> >> 'username' is allowed to use port 143.
> > 

I assume what you've described above is how things _should_ work. I'm
experiencing the following (had it on 2.2.5, still the same on
2.2.9rc1):

When my usermap table has: 

login      sock_allow        sock_deny      userid
---------------------------------------------------------------
ANY        inet:0.0.0.0:110

nobody can login to pop, have to add %s in userid column

If I add the :0 rule: 

login      sock_allow        sock_deny      userid
--------------------------------------------------------------
ANY        inet:0.0.0.0:0                   nosuchusergoawaynow
ANY        inet:0.0.0.0:110                 %s
Login is again denied for everyone on pop (aparently :0 takes preference over 
:110 here)


If I change :0 to :143 

login      sock_allow        sock_deny      userid
--------------------------------------------------------------
ANY        inet:0.0.0.0:143                 nosuchusergoawaynow
ANY        inet:0.0.0.0:110                 %s
Login is again denied on allowed on pop, denied on imap, which is exactly what 
I want


Then I add username to allow for imap to be used by that user: 

login      sock_allow        sock_deny      userid
--------------------------------------------------------------
ANY        inet:0.0.0.0:143                 nosuchusergoawaynow
ANY        inet:0.0.0.0:110                 %s
username   inet:0.0.0.0:143                 
Login is still denied on imap for user username.


Even removing the ANY  :143 line won't give username access to imap

login      sock_allow        sock_deny      userid
--------------------------------------------------------------
ANY        inet:0.0.0.0:110                 %s
username   inet:0.0.0.0:143                 


We need to spell out it's userid:

login      sock_allow        sock_deny      userid
--------------------------------------------------------------
ANY        inet:0.0.0.0:110                 %s
username   inet:0.0.0.0:143                 username


Even that won't help us in the default imap deny, allow for single user
scenario:


login      sock_allow        sock_deny      userid
--------------------------------------------------------------
ANY        inet:0.0.0.0:143                 nosuchusergoawaynow
ANY        inet:0.0.0.0:110                 %s
username   inet:0.0.0.0:143                 username


Login is still denied on imap for user username.



Grtz, Casper




_______________________________________________
DBmail mailing list
[email protected]
https://mailman.fastxs.nl/mailman/listinfo/dbmail

Reply via email to