New: howto/restrict.mail.user.to.login.from.specified.ip.or.networks.md.
This commit is contained in:
parent
06d3ee2650
commit
226a7df463
2
TODO.md
2
TODO.md
|
@ -1,7 +1,5 @@
|
||||||
# TODO
|
# TODO
|
||||||
|
|
||||||
https://bitbucket.org/zhb/iredmail/commits/b721a9c376f67a4a11b4b1761386a266cfd11f96
|
|
||||||
|
|
||||||
* How to install and configure SOGo groupware
|
* How to install and configure SOGo groupware
|
||||||
* How to install and configure Nginx
|
* How to install and configure Nginx
|
||||||
* How to custom SpamAssassin scores
|
* How to custom SpamAssassin scores
|
||||||
|
|
|
@ -0,0 +1,36 @@
|
||||||
|
# Restrict mail user to login from specified IP addresses or networks
|
||||||
|
|
||||||
|
Since iRedMail-0.9.1, it's able to restrict mail users to login from specified
|
||||||
|
IP addresses or networks.
|
||||||
|
|
||||||
|
Below sample usage shows how to restrict mail user `user@domaim.com` to login
|
||||||
|
from only IP address `172.16.244.1` or network `192.168.1.0/24`.
|
||||||
|
|
||||||
|
## SQL backends
|
||||||
|
|
||||||
|
```
|
||||||
|
sql> USE vmail;
|
||||||
|
sql> UPDATE mailbox SET allow_nets='172.16.244.1,192.168.1.0/24' WHERE username='user@domain.com';
|
||||||
|
```
|
||||||
|
|
||||||
|
To remove this restriction (allow to login from anywhere), just set
|
||||||
|
value of SQL column `mailbox.allow_nets` to NULL. WARNING: It must be NULL,
|
||||||
|
not empty string.
|
||||||
|
|
||||||
|
## How to restrict with OpenLDAP backend
|
||||||
|
|
||||||
|
To allow user `user@domain.com` to login from IP `172.16.244.1` and network
|
||||||
|
`192.168.1.0/24`, please add new attribute `allowNets` to this user:
|
||||||
|
|
||||||
|
```
|
||||||
|
allowNets: 192.168.1.10,192.168.1.0/24
|
||||||
|
```
|
||||||
|
|
||||||
|
To remove this restriction, just remove attribute `allowNets` for this user.
|
||||||
|
|
||||||
|
# References
|
||||||
|
|
||||||
|
* This feature is implemented in iRedMail-0.9.1, and mentioned in iRedMail
|
||||||
|
[upgrade tutorial for iRedMail-0.9.0](./upgrade.iredmail.0.9.0-0.9.1.html]
|
||||||
|
|
||||||
|
* Dovecot document: [AllowNets](http://wiki2.dovecot.org/PasswordDatabase/ExtraFields/AllowNets)
|
|
@ -72,6 +72,7 @@
|
||||||
<li><a href="pipe.incoming.email.for.certain.user.to.external.script.html">Pipe incoming email for certain user to external script </a></li>
|
<li><a href="pipe.incoming.email.for.certain.user.to.external.script.html">Pipe incoming email for certain user to external script </a></li>
|
||||||
<li><a href="recalculate.mailbox.quota.html">Force Dovecot to recalculate mailbox quota</a></li>
|
<li><a href="recalculate.mailbox.quota.html">Force Dovecot to recalculate mailbox quota</a></li>
|
||||||
<li><a href="reset.user.password.html">Reset user password</a></li>
|
<li><a href="reset.user.password.html">Reset user password</a></li>
|
||||||
|
<li><a href="restrict.mail.user.to.login.from.specified.ip.or.networks.html">Restrict mail user to login from specified IP addresses or networks</a></li>
|
||||||
<li><a href="send.out.email.from.specified.ip.addresses.html">Send out email from specified IP address</a></li>
|
<li><a href="send.out.email.from.specified.ip.addresses.html">Send out email from specified IP address</a></li>
|
||||||
<li><a href="sql.create.domain.catchall.account.html">SQL: Add domain catch-all account</a></li>
|
<li><a href="sql.create.domain.catchall.account.html">SQL: Add domain catch-all account</a></li>
|
||||||
<li><a href="sql.create.mail.alias.html">SQL: Add a mail alias account</a></li>
|
<li><a href="sql.create.mail.alias.html">SQL: Add a mail alias account</a></li>
|
||||||
|
|
|
@ -0,0 +1,51 @@
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||||||
|
<title>Restrict mail user to login from specified IP addresses or networks</title>
|
||||||
|
<link href="./css/markdown.css" rel="stylesheet"></head>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
|
||||||
|
<div id="navigation">
|
||||||
|
<a href="http://www.iredmail.org" target="_blank">iRedMail web site</a>
|
||||||
|
|
||||||
|
// <a href="./index.html">Document Index</a>
|
||||||
|
</div><h1 id="restrict-mail-user-to-login-from-specified-ip-addresses-or-networks">Restrict mail user to login from specified IP addresses or networks</h1>
|
||||||
|
<p>Since iRedMail-0.9.1, it's able to restrict mail users to login from specified
|
||||||
|
IP addresses or networks.</p>
|
||||||
|
<p>Below sample usage shows how to restrict mail user <code>user@domaim.com</code> to login
|
||||||
|
from only IP address <code>172.16.244.1</code> or network <code>192.168.1.0/24</code>.</p>
|
||||||
|
<h2 id="sql-backends">SQL backends</h2>
|
||||||
|
<pre><code>sql> USE vmail;
|
||||||
|
sql> UPDATE mailbox SET allow_nets='172.16.244.1,192.168.1.0/24' WHERE username='user@domain.com';
|
||||||
|
</code></pre>
|
||||||
|
|
||||||
|
<p>To remove this restriction (allow to login from anywhere), just set
|
||||||
|
value of SQL column <code>mailbox.allow_nets</code> to NULL. WARNING: It must be NULL,
|
||||||
|
not empty string.</p>
|
||||||
|
<h2 id="how-to-restrict-with-openldap-backend">How to restrict with OpenLDAP backend</h2>
|
||||||
|
<p>To allow user <code>user@domain.com</code> to login from IP <code>172.16.244.1</code> and network
|
||||||
|
<code>192.168.1.0/24</code>, please add new attribute <code>allowNets</code> to this user:</p>
|
||||||
|
<pre><code>allowNets: 192.168.1.10,192.168.1.0/24
|
||||||
|
</code></pre>
|
||||||
|
|
||||||
|
<p>To remove this restriction, just remove attribute <code>allowNets</code> for this user.</p>
|
||||||
|
<h1 id="references">References</h1>
|
||||||
|
<ul>
|
||||||
|
<li>
|
||||||
|
<p>This feature is implemented in iRedMail-0.9.1, and mentioned in iRedMail
|
||||||
|
[upgrade tutorial for iRedMail-0.9.0](./upgrade.iredmail.0.9.0-0.9.1.html]</p>
|
||||||
|
</li>
|
||||||
|
<li>
|
||||||
|
<p>Dovecot document: <a href="http://wiki2.dovecot.org/PasswordDatabase/ExtraFields/AllowNets">AllowNets</a></p>
|
||||||
|
</li>
|
||||||
|
</ul><p style="text-align: center; color: grey;">Document published under a <a href="http://creativecommons.org/licenses/by-nd/3.0/us/" target="_blank">CC BY-ND 3.0</a> license. If you found something wrong, please do <a href="http://www.iredmail.org/contact.html">contact us</a> to fix it.<script>
|
||||||
|
(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
|
||||||
|
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
|
||||||
|
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
|
||||||
|
})(window,document,'script','//www.google-analytics.com/analytics.js','ga');
|
||||||
|
|
||||||
|
ga('create', 'UA-3293801-21', 'auto');
|
||||||
|
ga('send', 'pageview');
|
||||||
|
</script>
|
||||||
|
</body></html>
|
|
@ -457,7 +457,7 @@ mysql> ALTER TABLE mailbox ADD COLUMN `allow_nets` TEXT DEFAULT NULL;
|
||||||
<p>Sample usage: allow user <code>user@domain.com</code> to login from IP <code>172.16.244.1</code> and
|
<p>Sample usage: allow user <code>user@domain.com</code> to login from IP <code>172.16.244.1</code> and
|
||||||
network <code>192.168.1.0/24</code>:</p>
|
network <code>192.168.1.0/24</code>:</p>
|
||||||
<pre><code>sql> USE vmail;
|
<pre><code>sql> USE vmail;
|
||||||
sql> UPDATE mailbox SET allow_nets='172.16.244.1,192.168.1.0/24';
|
sql> UPDATE mailbox SET allow_nets='172.16.244.1,192.168.1.0/24' WHERE username='user@domain.com`;
|
||||||
</code></pre>
|
</code></pre>
|
||||||
|
|
||||||
<p>To remove this restriction, just set <code>mailbox.allow_nets</code> to <code>NULL</code>, not empty string.</p>
|
<p>To remove this restriction, just set <code>mailbox.allow_nets</code> to <code>NULL</code>, not empty string.</p>
|
||||||
|
@ -554,7 +554,7 @@ sql> ALTER TABLE mailbox ADD COLUMN allow_nets TEXT DEFAULT NULL;
|
||||||
<p>Sample usage: allow user <code>user@domain.com</code> to login from IP <code>172.16.244.1</code> and
|
<p>Sample usage: allow user <code>user@domain.com</code> to login from IP <code>172.16.244.1</code> and
|
||||||
network <code>192.168.1.0/24</code>:</p>
|
network <code>192.168.1.0/24</code>:</p>
|
||||||
<pre><code>sql> \c vmail;
|
<pre><code>sql> \c vmail;
|
||||||
sql> UPDATE mailbox SET allow_nets='172.16.244.1,192.168.1.0/24';
|
sql> UPDATE mailbox SET allow_nets='172.16.244.1,192.168.1.0/24' WHERE username='user@domain.com`;
|
||||||
</code></pre>
|
</code></pre>
|
||||||
|
|
||||||
<p>To remove this restriction, just set <code>mailbox.allow_nets</code> to <code>NULL</code>, not empty string.</p>
|
<p>To remove this restriction, just set <code>mailbox.allow_nets</code> to <code>NULL</code>, not empty string.</p>
|
||||||
|
|
|
@ -469,7 +469,7 @@ network `192.168.1.0/24`:
|
||||||
|
|
||||||
```
|
```
|
||||||
sql> USE vmail;
|
sql> USE vmail;
|
||||||
sql> UPDATE mailbox SET allow_nets='172.16.244.1,192.168.1.0/24';
|
sql> UPDATE mailbox SET allow_nets='172.16.244.1,192.168.1.0/24' WHERE username='user@domain.com`;
|
||||||
```
|
```
|
||||||
|
|
||||||
To remove this restriction, just set `mailbox.allow_nets` to `NULL`, not empty string.
|
To remove this restriction, just set `mailbox.allow_nets` to `NULL`, not empty string.
|
||||||
|
@ -588,7 +588,7 @@ network `192.168.1.0/24`:
|
||||||
|
|
||||||
```
|
```
|
||||||
sql> \c vmail;
|
sql> \c vmail;
|
||||||
sql> UPDATE mailbox SET allow_nets='172.16.244.1,192.168.1.0/24';
|
sql> UPDATE mailbox SET allow_nets='172.16.244.1,192.168.1.0/24' WHERE username='user@domain.com`;
|
||||||
```
|
```
|
||||||
|
|
||||||
To remove this restriction, just set `mailbox.allow_nets` to `NULL`, not empty string.
|
To remove this restriction, just set `mailbox.allow_nets` to `NULL`, not empty string.
|
||||||
|
|
Loading…
Reference in New Issue