Re: Accept passwords for certain users from certain ip's only

On Tue, Feb 21, 2006 at 12:22:05PM +0200, Alex Schaft wrote:
> I'm considering opening up pop3 to some users on my network from outside 
> the office. Is there a way to get the password program to deny certain 
> users based on ip address?

Standard checkpassword will not support this without patching (basically
checking TCPREMOTEIP in addition to checking user/password).  However,
if what you really want to do is to allow (for example) userA to POP
only from one or more IP addresses (which may/may not be fixed), then
the most flexible solution is to write a script similar to this:

#!/bin/sh
#
# IPguardian - check $USER's IP and decide whether to launch prog
#
# Usage: IPguardian <prog> <arg>...
#
# WARNING: Untested - use at your own risk

# "testUserIP" is a hypothetical program that takes a username and IP
# address, then looks up a DB or otherwise verifies that s/he is
# allowed to access <prog> from that IP.  It exits 0 *only* if the
# abovementioned test succeeds.
if testUserIP $USER $TCPREMOTEIP; then
  # test passed - launch <prog>
  exec "$@"
else
  # test failed - abort as if password was incorrect
  # (see http://cr.yp.to/checkpwd/interface.html for details)
  exit 1
fi

You'd then insert it into your POP3 run script just after checkpassword,
e.g.:

  ... checkpassword qmail-pop3d ...

becomes:

  ... checkpassword IPguardian qmail-pop3d ...

Restart your POP3 service, and you're done.

- Adrian