Restricting external access

[EiZ]

Hello,

I would like to restrict user access based on the following scheme :

- if the client IP is from my internal network : full access granted
- if the client IP is outside my internal network : access to web client and imap/pop proxy is restricted to a group of users.

I plan to force the remote web access through a http reverse-proxy and put a zimbra-proxy in DMZ for remote imaps/pops access.

So the access scheme can also be read this way :

- if the client access the zimbra-apache server (which is only reachable from the internal network) : no restriction
- if the client access the zimbra web client through the http reverse proxy OR if the client access the zimbra-proxy in DMZ : access is restricted to a specific group of users

What is the best way to implement this policy ? Is there a way with COS ? Can PAM be used ? Must I rely on External Auth ?

Thanks for your advices.

[uxbod]

or leave Zimbra as is and use IPTables (or some variant). What version of Zimbra and O/S ? http://www.zimbra.com/forums/announc...r-profile.html

[osmedts]

That's not what EiZ asked. What you're pointing at is a way to restrict (in/out) SMTP. What he's searching is a way to restrict some users from logging in (through HTTP, POP, IMAP) when they use a specific zimbra proxy (basically, when they're outside the LAN).

Is there a way to do that with an LDAP filter (used for domain authentication) ? Are there any parameters (%...) which can be used to check the client's IP or the zimbra proxy he's using ?

Or maybe with a specific zimbra-proxy configuration ?

[uxbod]

If using a reverse proxy why not use with say Squid and set up access groups ? I believe you could then tie the authentication in with the ZM LDAP. Just thinking out loud.

[EiZ]

The reverse-proxy hackery will only work to limit the http access and I don't see how to avoid double sign on.

PAM would be the saver here if zimbra auth component allowed a PAM stack traversal.

But I believe zimbra does not use PAM. Am I wrong ?