Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have 50 email users (virtual users) using Dovecot, Postfix and Squirrelmail with CentOS 6.0. I want to allow some users to have access to POP and IMAP globally, and for the remaining users from my LAN only.

I have tried using Dovecot's allow_nets features, but this does not fulfill my requirements.

If I allow in allow_nets, the restricted user can access webmail globally. If I disable in allow_nets, the restricted user can not access webmail from my LAN too. Below is my configuration.

restricted virtual email user (/etc/dovecot/passwd file){CRAM-MD5}encrypted pass::::::allow_nets=,

global virtual email user (/etc/dovecot/passwd-file){CRAM-MD5}encrypted pass
share|improve this question

When accessing mail using webmail, the connections to Dovecot are made directly from SquirrelMail running on the same machine, and so always come from regardless of where the user is. Dovecot has no way of knowing where the user is accessing SquirrelMail from. You therefore need to implement the restriction for webmail in SquirrelMail itself (or in front of SquirrelMail with iptables for example).

share|improve this answer

I found a squirrelmail plugin named ip_restriction which helps to restrict IP based authentication.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.