From: Wietse Venema (wietseporcupine.org)
Date: Mon Aug 04 2008 - 18:30:44 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Daniel Black:
> Story is I deployed a webmail with certificate based authentication that
> substitues a global master password
> (http://wiki.dovecot.org/Authentication/MasterUsers) when the certificate
> matches. The webmail accesses the inbox by imap and reuses the password for
> smtp through postfix.
>
> I configured dovecot sasl authentication to allow a particular global password
> to be allowed from one IP address of the webmail server. Unfortuanately it
> seems as though postfix doesn't pass rip= (remote ip) or the other AUTH
> parameters of the protocol (http://dovecot.org/doc/auth-protocol.txt).

Postfix passes the information in the SMTP client's AUTH command.
This is how I got the Dovecot extension from Timo. If someone is
willing to monitor his docs for changes, then they are welcome to
do so. I won't.

> Is adding these parameters to postfix's sasl authentication a useful feature
> request?
>
> Should I be doing this another way?

Just whitelist the client with:

/etc/postfix/main.cf:
    smtpd_recipient_restrictions =
        ...
        check_client_access hash:/etc/postfix/sasl_whitelist
        permit_sasl_authenticated
        ...

/etc/postfix/sasl_whitelist:
    1.2.3.4 OK

        Wietse

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]