Re: Restrict IMAP admin logins in Cyrus

[Damijan SenÄar <damijan@xxxxxxxxxx>]

On 01/13/2011 02:35 AM, Lucas Zinato Carraro wrote:

ÂÂ Its possible to limit imap admin logins ?

For example limit admin only for a specific IP.

ÂÂ Exist a way to grant permission for a specific user for administratives tasks but limit this user

to delete accounts ?

Regards

Zinato

Â

----
Cyrus Home Page: http://www.cyrusimap.org/
List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/

You may want to setup your conf files like:

/etc/cyrus.conf

# standard standalone server implementation

START {
 # do not delete this entry!
 recover cmd="ctl_cyrusdb -r"

 # this is only necessary if using idled for IMAP IDLE
 idled cmd="idled"
}

# UNIX sockets start with a slash and are put into /var/lib/imap/sockets
SERVICES {
 # add or remove based on preferences
 imaplocal cmd="imapd -C /etc/imapd-local.conf" listen="127.0.0.1:8888" prefork=0
 imap cmd="imapd" listen="imap" listen="your-imapd-server-ip:imap" prefork=5
 imaps cmd="imapd -s" listen="imaps" prefork=1
#Â pop3ÂÂÂÂÂÂÂÂ cmd="pop3d" listen="pop3" prefork=3
#Â pop3sÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ cmd="pop3d -s" listen="pop3s" prefork=1
 sieve cmd="timsieved" listen="sieve" prefork=1

 # these are only necessary if receiving/exporting usenet via NNTP
#Â nntpÂÂÂÂÂÂÂÂ cmd="nntpd" listen="nntp" prefork=3
#Â nntpsÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ cmd="nntpd -s" listen="nntps" prefork=1

 # at least one LMTP is required for delivery
#Â lmtpÂÂÂÂÂÂÂÂ cmd="lmtpd" listen="lmtp" prefork=0
 lmtpunix cmd="lmtpd" listen="/var/lib/imap/socket/lmtp" prefork=1

 # this is only necessary if using notifications
#Â notifyÂÂÂÂÂÂ cmd="notifyd" listen="/var/lib/imap/socket/notify" proto="udp" prefork=1
}

EVENTS {
 # this is required
 checkpoint cmd="ctl_cyrusdb -c" period=30

 # this is only necessary if using duplicate delivery suppression,
 # Sieve or NNTP
 delprune cmd="cyr_expire -E 3" at=0400

 # this is only necessary if caching TLS sessions
 tlsprune cmd="tls_prune" at=0400
}

/etc/imapd.conf

configdirectory: /var/lib/imap
partition-default: /var/spool/imap
## comment for local admins: cyrus
#admins: cyrus
sievedir: /var/lib/imap/sieve
sendmail: /usr/sbin/sendmail
hashimapspool: true
sasl_pwcheck_method: saslauthd
allowplaintext: yes

lmtp_downcase_rcpt: yes
defaultdomain: your-domain
autocreatequota: 100000
quotawarn: 90

servername: your-server

sasl_saslauthd_path: /var/run/saslauthd/mux

berkeley_cachesize: 16384

sasl_mech_list: PLAIN
tls_cert_file: /etc/pki/cyrus-imapd/cyrus-imapd.pem
tls_key_file: /etc/pki/cyrus-imapd/cyrus-imapd.pem
tls_ca_file: /etc/pki/tls/certs/ca-bundle.crt
# uncomment this if you're operating in a DSCP environment (RFC-4594)
# qosmarking af13


/etc/imapd-local.conf

configdirectory: /var/lib/imap
partition-default: /var/spool/imap
admins: cyrus
sievedir: /var/lib/imap/sieve
sendmail: /usr/sbin/sendmail
hashimapspool: true
sasl_pwcheck_method: saslauthd
allowplaintext: yes

lmtp_downcase_rcpt: yes
defaultdomain: your-domain
quotawarn: 90

servername: your-server

sasl_mech_list: PLAIN
tls_cert_file: /etc/pki/cyrus-imapd/cyrus-imapd.pem
tls_key_file: /etc/pki/cyrus-imapd/cyrus-imapd.pem
tls_ca_file: /etc/pki/tls/certs/ca-bundle.crt
# uncomment this if you're operating in a DSCP environment (RFC-4594)
# qosmarking af13


As you see your default imapd.conf config file dosen't have admin account defined.
Admin accunt is defined in imapd-local.conf.

You can access your admin account like:

cyradm --user cyrus --port 8888 localhost

You can changet localhost to your host IP and control access to cyrus admin port with e.g. iptables.

Best regards,

Damijan

----
Cyrus Home Page: http://www.cyrusimap.org/
List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/