Ok, so this is my code. I'm not sure it's in the best place, but it works.
Indentation may be wrong, and it's python so please be careful.
edit /var/www/iredmail/libs/mysql/core.py
Insert immediately after this section:
# Verify password
authenticated = False
if iredpwd.verify_md5_password(password_sql, password) \
or iredpwd.verify_plain_md5_password(password_sql, password) \
or password_sql in [password, '{PLAIN}' + password] \
or iredpwd.verify_ssha_password(password_sql, password) \
or iredpwd.verify_ssha512_password(password_sql, password):
authenticated = True
The following code:
if session.get('admin_is_mail_user'):
if record.get('isglobaladmin', 0) == 1:
if settings.GLOBAL_ADMIN_IP_RESTRICTION and str(session.ip) not in settings.GLOBAL_ADMIN_IP_LIST:
authenticated = False
else:
result = self.conn.select(
'domain_admins',
vars={'username': username, 'domain': 'ALL', },
what='domain',
where='username=$username AND domain=$domain',
limit=1,
)
if len(result) == 1:
if settings.GLOBAL_ADMIN_IP_RESTRICTION and str(session.ip) not in settings.GLOBAL_ADMIN_IP_LIST:
authenticated = False
Afterwards, this existing code below should follow:
if not authenticated:
return (False, 'INVALID_CREDENTIALS')
if verifyPassword is not True:
session['username'] = username
session['logged'] = True
Save.
Edit /var/www/iredadmin/settings.py
Add the following lines, adjusting IP list to suit:
GLOBAL_ADMIN_IP_RESTRICTION = True
GLOBAL_ADMIN_IP_LIST = ['10.0.0.1','10.0.0.2','192.168.1.5']
Save.
Restart httpd, e.g.:
/etc/init.d/httpd restart
That should restrict global admin logins to those IPs specified in settings.py
Please let me know if the code looks okay.
If anyone wishes to use, distribute or modify this code, it's okay with me, provided it is at your own risk and does not otherwise infringe.
