<html><head><title>Re: non-encrypted for local queries</title>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-15">
</head>
<body>
<span style=" font-family:'Verdana'; font-size: 10pt;">Hello Raphael,<br>
<br>
Of course! and thank you.<br>
<br>
Reg.<br>
<br>
Wednesday, March 17, 2010, 8:53:08 AM, you wrote:<br>
<br>
<span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b>> Use the following in /etc/cyrus.conf:<br>
<br>
> imap cmd="imapd" listen="[127.0.0.1]:imap" prefork={number}<br>
<br>
> imaps cmd="imapd -s" listen="imaps" prefork={number}<br>
<br>
> That will allow connections to port 143 from localhost only and to port<br>
> 993 from anywhere. That first entry is also required for cyradm to work<br>
> on the local box unless you've got a version with SSL support. We also<br>
> run Horde on separate servers, so that uses port 993. However our <br>
> Luminis portal's email client doesn't support SSL or TLS, so we use a <br>
> dedicated crossover cable between servers in this case and have an imap<br>
> instance bind to the private link's interface in the same manner as the<br>
> localhost example above.<br>
<br>
> Rafe<br>
<br>
<br>
> Nybbles2Byte wrote:<br>
<span style=" color: #800080;">>> Hello Raphael,<br>
<br>
>> Thanks but I'm not looking to restrict access just to the LAN. I'm <br>
>> looking to allow unencrypted access via localhost (and as a bonus via <br>
>> the LAN but not necessary) but only encrypted access via the WAN. Which <br>
>> I believe boils down to port 143 for localhost and 993 for the WAN. <br>
<br>
>> This allows me to have an application like horde which I can use for web <br>
>> mail to talk with cyrus unencrypted being on the same server while <br>
>> remote users being required to have a secure line. After all, why make <br>
>> the server encrypt communications to talk to itself? That's just chewing <br>
>> up resources for no good reason.<br>
<br>
<br>
>> Wednesday, March 17, 2010, 8:11:10 AM, you wrote:<br>
<br>
>> *> Use the following as the only "imapd" command configured in <br>
<span style=" color: #800000;">>>> /etc/cyrus.conf to accept connections from localhost only:<br>
<br>
>>> imap cmd="imapd" listen="[127.0.0.1]:imap" prefork={number}<br>
<br>
>>> You can restrict access to hosts from the LAN without using the firewall<br>
>>> using at least a couple of methods:<br>
<br>
>>> 1) Assuming cyrus was compiled with libwrap support, you can restrict <br>
>>> access to the imap service in /etc/hosts.allow (or /etc/hosts.deny).<br>
<br>
>>> 2) If the LAN you mentioned below is private (no access from other <br>
>>> subnets and networks), you can use the following in /etc/cyrus.conf in<br>
>>> addition to the entry I mentioned above:<br>
<br>
>>> imap cmd="imapd" listen="[{LAN-interface-address}]:imap" <br>
>>> prefork={number}<br>
<br>
>>> Nybbles2Byte wrote:<br>
>>> > Hello Info-cyrus,<br>
<br>
>>> > Is there a way to tell cyrus to accept non-encrypted port 143 queries <br>
>>> > from localhost (and perhaps the LAN) but not remotely? I guess you <br>
>>> > could allow unencrypted requests in cyrus but block 143 in your firewall <br>
>>> > but I am wondering if there is purely cyrus settings solution.<br>
<br>
>>> > /-- <br>
>>> > Nybbles2Byte <a style=" font-weight: normal;" href="mailto:nybbles2byte@gmail.com/">mailto:nybbles2byte@gmail.com/</a><br>
<br>
>>> > /<br>
>>> > /<br>
>>> > ------------------------------------------------------------------------<br>
>>> > /<br>
>>> > ----<br>
>>> > Cyrus Home Page: <a style=" font-weight: normal;" href="http://cyrusimap.web.cmu.edu/">http://cyrusimap.web.cmu.edu/</a><br>
>>> > Cyrus Wiki/FAQ: <a style=" font-weight: normal;" href="http://cyrusimap.web.cmu.edu/twiki">http://cyrusimap.web.cmu.edu/twiki</a><br>
>>> > List Archives/Info: <a style=" font-weight: normal;" href="http://asg.web.cmu.edu/cyrus/mailing-list.html/">http://asg.web.cmu.edu/cyrus/mailing-list.html/</a><br>
<br>
<br>
<br>
<br>
<span style=" color: #800080;">>> */-- <br>
>> Nybbles2Byte <a style=" font-weight: normal;" href="mailto:nybbles2byte@gmail.com/">mailto:nybbles2byte@gmail.com/</a><br>
<br>
<br>
<br>
<br>
</span></span></span></b><span style=" font-family:'arial'; font-size: 8pt; color: #c0c0c0;"><i>-- <br>
Nybbles2Byte <a style=" font-style: normal;" href="mailto:nybbles2byte@gmail.com">mailto:nybbles2byte@gmail.com</a></body>