External Webmail - only allow certain users

[zippy32]

I have a new installation with the Mailstore server in the internal network and a zimbra proxy server in the DMZ. I am using external authentication using AD. All is working fine, but all users have access to Webmail from anywhere.

Is there anyway that permissions can be added to proxy server to only allow certain users to use the proxy server?

[karthik@est]

nope.. had same requirement and Zimbra support said there is no settings as such to restricting users from accessing webmail.
This is a security issue, for few security compliance this option should be available.

[Himanshu]

Originally Posted by zippy32

I have a new installation with the Mailstore server in the internal network and a zimbra proxy server in the DMZ. I am using external authentication using AD. All is working fine, but all users have access to Webmail from anywhere.

Is there anyway that permissions can be added to proxy server to only allow certain users to use the proxy server?

We have restricted the Users in UTM which sits between MailServer & Internet

[mattg1]

I don't know if this technique would apply to your proxy & AD environment, but like you, we wanted to be able to control who can access the Zimbra web interface from outside. So, we set up a simple PHP web page which presents a login form, and checks if the userid is on our permit list. If not, a simple rejection page is diplayed. Or, if they are permitted, the page authenticates the userid/pw combo against kerberos, generates a Zimbra preauth token, and then redirects them to the Zimbra web interface. The wiki has info on how to use preauthentication.

[Himanshu]

Originally Posted by mattg1

I don't know if this technique would apply to your proxy & AD environment, but like you, we wanted to be able to control who can access the Zimbra web interface from outside. So, we set up a simple PHP web page which presents a login form, and checks if the userid is on our permit list. If not, a simple rejection page is diplayed. Or, if they are permitted, the page authenticates the userid/pw combo against kerberos, generates a Zimbra preauth token, and then redirects them to the Zimbra web interface. The wiki has info on how to use preauthentication.

Yes . Good Way to Implement . We are Picking of Group of Directory Users who are allowed to Access E-mails from WAN.There are Provisions to create Local Users in Most UTM.