Re: Feature request: exclude IP/network in allow_nets extra field

2019-05-01 Thread A. Schulze via dovecot
Am 30.04.19 um 03:56 schrieb Zhang Huangbin via dovecot: > Dear all, > > We use `allow_nets`[1] to restrict login clients, it works fine. > Recently we need to allow some users to login from everywhere except some > IP/networks, how can we accomplish this with "allow_nets"? > > Tried allow_net

Re: Feature request: exclude IP/network in allow_nets extra field

2019-04-30 Thread Zhang Huangbin via dovecot
> On Apr 30, 2019, at 10:37 PM, andre via dovecot wrote: > > You can easily do this without a new feature in Dovecot. > > - Create a post login script, for instance, in bash. > - install grepcidr on your server. > > Your post login script can use grepcidr to check for white or black list. >

Re: Feature request: exclude IP/network in allow_nets extra field

2019-04-30 Thread Zhang Huangbin via dovecot
> On Apr 30, 2019, at 2:35 PM, Sami Ketola via dovecot > wrote: > > Just create another passdb for these premium users before the actual passdb > and add skip = authenticated to the actual passdb. Dear Sami, Thank you for the suggestion. Adding more passdb is not ideal at all, if we have

Re: Feature request: exclude IP/network in allow_nets extra field

2019-04-30 Thread Zhang Huangbin via dovecot
> On Apr 30, 2019, at 2:32 PM, Malcolm via dovecot wrote: > > On 4/29/2019 11:20 PM, Zhang Huangbin via dovecot wrote: >> I understand what "allow" means. But it will be very handy to support >> something like "!a.b.c.d" to allow all but just exclude few >> IPs/networks. Isn't it? :) > I'm no

Re: Re: Feature request: exclude IP/network in allow_nets extra field

2019-04-30 Thread andre via dovecot
Sorry for the top posting, I have not setup my new phone yet. Here the script sample: https://github.com/progmaticltd/homebox/blob/dev/install/playbooks/roles/dovecot/files/access-check-whitelist.sh André. Tue Apr 30 15:33:51 GMT+01:00 2019 andre : > > Hello, Zhang. > > You can easily do thi

Re: Feature request: exclude IP/network in allow_nets extra field

2019-04-30 Thread andre via dovecot
Hello, Zhang. You can easily do this without a new feature in Dovecot. - Create a post login script, for instance, in bash. - install grepcidr on your server. Your post login script can use grepcidr to check for white or black list. https://wiki.dovecot.org/PostLoginScripting I have impleme

Re: Feature request: exclude IP/network in allow_nets extra field

2019-04-30 Thread @lbutlr via dovecot
On 30 Apr 2019, at 00:20, Zhang Huangbin via dovecot wrote: > On Apr 30, 2019, at 11:21 AM, @lbutlr via dovecot wrote: >> >> On 29 Apr 2019, at 19:56, Zhang Huangbin via dovecot >> wrote: >>> Recently we need to allow some users to login from everywhere except some >>> IP/networks, >> >> Ca

Re: Feature request: exclude IP/network in allow_nets extra field

2019-04-29 Thread Sami Ketola via dovecot
> On 30 Apr 2019, at 4.56, Zhang Huangbin via dovecot > wrote: > > Dear all, > > We use `allow_nets`[1] to restrict login clients, it works fine. > Recently we need to allow some users to login from everywhere except some > IP/networks, how can we accomplish this with "allow_nets"? > > Tri

Re: Feature request: exclude IP/network in allow_nets extra field

2019-04-29 Thread Malcolm via dovecot
On 4/29/2019 11:20 PM, Zhang Huangbin via dovecot wrote: I understand what "allow" means. But it will be very handy to support something like "!a.b.c.d" to allow all but just exclude few IPs/networks. Isn't it? :) I'm not sure why: iptables -A INPUT -p tcp --match multiport --syn ! -s a.b.c.d/

Re: Feature request: exclude IP/network in allow_nets extra field

2019-04-29 Thread Zhang Huangbin via dovecot
> On Apr 30, 2019, at 11:21 AM, @lbutlr via dovecot wrote: > > On 29 Apr 2019, at 19:56, Zhang Huangbin via dovecot > wrote: >> Recently we need to allow some users to login from everywhere except some >> IP/networks, > > Can you use firewall rules for this? I suppose not. We don't restric

Re: Feature request: exclude IP/network in allow_nets extra field

2019-04-29 Thread @lbutlr via dovecot
On 29 Apr 2019, at 19:56, Zhang Huangbin via dovecot wrote: > Recently we need to allow some users to login from everywhere except some > IP/networks, Can you use firewall rules for this? > how can we accomplish this with "allow_nets"? Allow_nets specifies allowed networks. Doesn't say anythi

Feature request: exclude IP/network in allow_nets extra field

2019-04-29 Thread Zhang Huangbin via dovecot
Dear all, We use `allow_nets`[1] to restrict login clients, it works fine. Recently we need to allow some users to login from everywhere except some IP/networks, how can we accomplish this with "allow_nets"? Tried allow_nets="!a.b.c.d", but Dovecot reports error "allow_nets: Invalid network '!a