Topic: Stopping internal POP3 email collection

[Mark Leman]

Hi,
I want to stop some of my users collecting POP3 email (because they have no antivirus s/w and use outlook) and force them to use the webmail interface. Is is possilbe to block POP3 access to either a range of users or a range of IP addresses on the internal network?

Thanks in advance, Mark Leman

[Mark Leman]

Ok if no one can help directly with this question, what package does e-smith use to provide the pop3 connection for the LAN users. Then I can go and research an answer to my own question

Thanks in advance, Mark Leman

>Hi,
>I want to stop some of my users collecting POP3 email (because they have no
> antivirus s/w and use outlook) and force them to use the webmail interface. Is is
> possilbe to block POP3 access to either a range of users or a range of IP
> addresses on the internal network?

[Bart]

Startup-script for the pop3-service is in /etc/rc.d/init.d/qmail-pop3.init
There is a link to it in /etc/rc.d/rc7.d (runlevel 7 is used by ESSG)

Now i think about it, it might even be easier to change /etc/xinetd.conf (and/or template for that).
Comment out the service pop-3 part in there and "killall -HUP xinetd"
to restart the inet-service, after that

Remember, no warranty, you're on your own in this.
Should work however. Good luck

-Bart-

[Mark Leman]

Bart, Thanks for the thoughts on stopping the POP3 service but what I want to do is only stop *some* users accessing POP3 not all of them.

I have been looking at how e-smith delivers its email to POP3 users, I think the mail is delivered to the ‘Maildir’ directory in the users home. From there I think the qmail-pop3 daemon collects it when a pop3 user connects.

So my thoughts are (and please remember I am a embedded systems programmer with little Linux experience so this could be completely wrong I could either:

1. Stop the users collecting pop3 mail by blocking their ip-ddress /port on the e-smith box. This could work but is not elegant because it relies on having a fix ip-address for each user; I currently do but want to use DHCP in the future.

2. Stop the email collection by the qmail-pop3 daemon for some users.

Option 2 looks a better. So I have looked at the qmail website and found the qmail-pop3 daemon uses ‘Checkpassword’ to verify the username and password provided by the pop3 user are valid. Several replacements for ‘Checkpassword’ are listed at http://www.qmail.org/top.html#checkpassword and some allow password checking against a different file from the standard ‘/etc/passwd’. I have downloaded checklocalpwd.c, which does just that. Now have to just:

1. Build a redhat linux box to compile ‘checklocalpwd’ on.
2. Add it to the e-smith box.
3. Work out how to integrate it in to e-smith.
4. Document it all as a how-to

Easy (I think I have a lot to learn)

Any thoughts welcome.

Regards, Mark Leman

> Startup-script for the pop3-service is in
> /etc/rc.d/init.d/qmail-pop3.init
> There is a link to it in /etc/rc.d/rc7.d
> (runlevel 7 is used by ESSG)
> Now i think about it, it might even be easier to
> change /etc/xinetd.conf(and/or template for that).
> Comment out the service pop-3 part in there and
> "killall -HUP xinetd"
> to restart the inet-service, after that
> Remember, no warranty, you're on your own in this.
> Should work however. Good luck
> -Bart-

[Bart]

Hi Mark,

Well, looks more like a development issue here (devinfo@lists.e-smith.org),
but just some thoughts on it:

Mark Leman wrote:
> 1. Stop the users collecting pop3 mail by blocking their
> ip-ddress /port on the e-smith box. This could work but is
> not elegant because it relies on having a fix ip-address for
> each user; I currently do but want to use DHCP in the future.
>

Au contraire; combining fixed IP with access is *very* elegant, certainly from a security perspective

Step 1.

Combine (your wish for..) DHCP with fixed IP-addresses!
 
  a) reserve (in your mind..) a IP-range for clients that are allowed to use pop3
  b) use the option Hostnames and addresses in the web-manager
    to link Ethernet-addresses to a fixed IPs.

Step 2.

Read the source, use the templates, Luke
 
 a) use netmasks and 'only_from' in /etc/xinetd.conf and the templates for that
     to deny access from certain ip-ranges  

For example, 192.168.0.10/29 (that is: 192.168.0.10 with netmask 255.255.255.248) specifies ip's 192.168.0.9 to 192.168.0.14

An "only-from" entry in the service-part of pop-3 in /etc/winetd.conf like "only_from = 192.168.0.10/29" will allow only machines 192.168.0.9 to 192.168.0.14 to use pop3.

BTW, if you are not well at computing netmasks (i am not for certain!)  use http://logi.cc/nw/NetCalc.php3 to calculate a certain netmask (and by that: the range) of which ip's should be allowed to use pop3.

(this method has been proven succesfully to secure access to swat, the samba-webtool - which i mainly use for experimental/test purposes)

It might not be the easiest way, but it is a clean way...without the need for any compilation...YMMV

- Bart