8 messages in net.sourceforge.lists.courier-usersRe: [courier-users] Re: Restrict POP ...
FromSent OnAttachments
Marc HaberJan 27, 2001 1:49 am 
Sam VarshavchikJan 27, 2001 2:18 am 
Marc HaberJan 27, 2001 2:33 pm 
Marc HaberMar 11, 2001 12:14 pm 
Roland SchneiderMar 11, 2001 1:01 pm 
jeff jansenMar 11, 2001 4:28 pm 
Patrick PriceMar 12, 2001 9:54 am 
Marc HaberMar 17, 2001 2:12 am 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:Re: [courier-users] Re: Restrict POP access methods for source IPActions...
From:Roland Schneider (rol@serv.ch)
Date:Mar 11, 2001 1:01:11 pm
List:net.sourceforge.lists.courier-users

--On Sonntag, 11. März 2001 21:14 +0100 Marc Haber <cour@marc-haber.de> wrote:

Yes. Configure the POP3 server listen on 127.0.0.1 only. > > After recent
bugtraq discussions, I now believe this is not good

enough a measure since systems can be easily coaxed into accepting packets destined for 127.0.0.1 when they come in from the outside.

There should be a way to allow connections only from certain source

IPs, maybe by just using TCP wrappers (linking to libwrap).

Courier's pop3d[-ssl] is started via couriertcpd, any access control should be made there. Add the option '-access=dbfile', in sbin/pop3d and create the dbfile:

127.0.0.1 allow * deny

and then makedat -src=${ACCESSFILE} \ -file=${ACCESSFILE}.dat \ -tmp=${ACCESSFILE}.tmp || exit 1

should work, its copied verbatim from sbin/makesmtpaccess :)

Roland