I would like to allow local clients to access email via any of pop3, pop3s, imap, or imaps if they so choose but restrict remote clients to pop3s and imaps only, simililarly to how I already do for smtp using the postfix directive:
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
The most suitible functionality I can find in Dovecot is to force all clients to use secure authentication with the
disable_plaintext_auth = yes directive.
As a workaround I can set
disable_plaintext_auth = no and add lines to my firewall using iptables to allow specific port access like so:
sudo iptables -A INPUT -i eth0 -p tcp -s 192.168.0.0/24 --dport 143 -j ACCEPT sudo iptables -A INPUT -i eth0 -p tcp --dport 993 -j ACCEPT sudo iptables -A INPUT -i eth0 -p tcp -s 192.168.0.0/24 --dport 110 -j ACCEPT sudo iptables -A INPUT -i eth0 -p tcp --dport 995 -j ACCEPT
But this seems rather hacky and introduces more issues for example: This wont allow STARTTLS over port 110 from a remote client.
Is there another way to allow local clients to authenticate with my postfix/dovecot system over either a secure or insecure connection while still forcing remote clients to only use a secure authentication?