Hi Paul,
> >> > >> From this you can deduce that setting up the policy you want, you > >> shouldn't use sock_deny, but rather map ANY user to a non-existent > userid. > >> > >> login sock_allow sock_deny userid > >> --------------------------------------------------------------- > >> ANY inet:0.0.0.0:0 nosuchusergoawaynow > >> ANY inet:0.0.0.0:110 > >> username inet:0.0.0.0:143 > >> > >> this way, users will be mapped to a non-existant user by default, > >> denying them access. The second and third records are more specific > so > >> when anyone tries to login on port 110, access is granted. But only > >> 'username' is allowed to use port 143. > > I assume what you've described above is how things _should_ work. I'm experiencing the following (had it on 2.2.5, still the same on 2.2.9rc1): When my usermap table has: login sock_allow sock_deny userid --------------------------------------------------------------- ANY inet:0.0.0.0:110 nobody can login to pop, have to add %s in userid column If I add the :0 rule: login sock_allow sock_deny userid -------------------------------------------------------------- ANY inet:0.0.0.0:0 nosuchusergoawaynow ANY inet:0.0.0.0:110 %s Login is again denied for everyone on pop (aparently :0 takes preference over :110 here) If I change :0 to :143 login sock_allow sock_deny userid -------------------------------------------------------------- ANY inet:0.0.0.0:143 nosuchusergoawaynow ANY inet:0.0.0.0:110 %s Login is again denied on allowed on pop, denied on imap, which is exactly what I want Then I add username to allow for imap to be used by that user: login sock_allow sock_deny userid -------------------------------------------------------------- ANY inet:0.0.0.0:143 nosuchusergoawaynow ANY inet:0.0.0.0:110 %s username inet:0.0.0.0:143 Login is still denied on imap for user username. Even removing the ANY :143 line won't give username access to imap login sock_allow sock_deny userid -------------------------------------------------------------- ANY inet:0.0.0.0:110 %s username inet:0.0.0.0:143 We need to spell out it's userid: login sock_allow sock_deny userid -------------------------------------------------------------- ANY inet:0.0.0.0:110 %s username inet:0.0.0.0:143 username Even that won't help us in the default imap deny, allow for single user scenario: login sock_allow sock_deny userid -------------------------------------------------------------- ANY inet:0.0.0.0:143 nosuchusergoawaynow ANY inet:0.0.0.0:110 %s username inet:0.0.0.0:143 username Login is still denied on imap for user username. Grtz, Casper
_______________________________________________ DBmail mailing list [email protected] https://mailman.fastxs.nl/mailman/listinfo/dbmail
