On 4/29/2019 11:20 PM, Zhang Huangbin via dovecot wrote:

I understand what "allow" means. But it will be very handy to support something like "!a.b.c.d" to allow all but just exclude few IPs/networks. Isn't it? :) I'm not sure why:

iptables -A INPUT -p tcp --match multiport --syn ! -s a.b.c.d/netmask
--dports 110,143,993,995 -j REJECT

doesn't do what you want.

Or do you want some kind of "friendlier" message to be provided once the user(s) login from the blocked IP#s to tell them why they can't login?

=M=

On 30 Apr 2019, at 00:20, Zhang Huangbin via dovecot dovecot@dovecot.org wrote:

On Apr 30, 2019, at 11:21 AM, @lbutlr via dovecot dovecot@dovecot.org wrote:

...

On 29 Apr 2019, at 19:56, Zhang Huangbin via dovecot dovecot@dovecot.org wrote:

...

Recently we need to allow some users to login from everywhere except some IP/networks,

Can you use firewall rules for this?

I suppose not. We don't restrict ALL users this way, just few of them.

This iOS sounding odder and odder.

And the client IP addresses may change frequently, not static IPs.

And? How is that an issue? Either way you are going to have to change a configuration. At least with a fireball, you don't have to reload dovecot each time.

...

...

how can we accomplish this with "allow_nets"?

Allow_nets specifies allowed networks. Doesn't say anything else about any other use.

"The allow_nets field is a comma separated list of IP addresses and/or networks where the user is allowed to log in from."

I understand what "allow" means. But it will be very handy to support something like "!a.b.c.d" to allow all but just exclude few IPs/networks. Isn't it? :)

I cannot imagine a case where I would find this useful, no.

-- "You never really understand a person until you see things from his point of view, until you climb inside of his skin and walk around in it."

On Apr 30, 2019, at 2:35 PM, Sami Ketola via dovecot dovecot@dovecot.org wrote:

Just create another passdb for these premium users before the actual passdb and add skip = authenticated to the actual passdb.

Dear Sami,

Thank you for the suggestion.

Adding more passdb is not ideal at all, if we have more access policies, we don't want to add more and more userdb/passdb. Dovecot already supports syntax "allow_nets=a.b.c.d", we just need something like "!" mark to exclude some IP/networks.

Sorry for the top posting, I have not setup my new phone yet.

Here the script sample: https://github.com/progmaticltd/homebox/blob/dev/install/playbooks/roles/dov...

André.

Tue Apr 30 15:33:51 GMT+01:00 2019 andre andre@rodier.me:

Hello, Zhang.

You can easily do this without a new feature in Dovecot.

• Create a post login script, for instance, in bash.
• install grepcidr on your server.

Your post login script can use grepcidr to check for white or black list.

https://wiki.dovecot.org/PostLoginScripting

I have implemented this myself on a small open source project, I can send you the links of you want.

André.

Tue Apr 30 02:57:18 GMT+01:00 2019 Zhang Huangbin via dovecot dovecot@dovecot.org:

...

Dear all,

We use allow_nets[1] to restrict login clients, it works fine. Recently we need to allow some users to login from everywhere except some IP/networks, how can we accomplish this with "allow_nets"?

Tried allow_nets="!a.b.c.d", but Dovecot reports error "allow_nets: Invalid network '!a.b.c.d'".

Can we have this feature?

i guess it should be done in function "auth_request_validate_networks"[2] in file src/auth/auth-request.c.

[1] allow_nets: https://wiki.dovecot.org/PasswordDatabase/ExtraFields/AllowNets [2] https://github.com/dovecot/core/blob/fbc3ccc4a9a02b82073585a33254eacedc6a995...