# Limiting number of mail(imap/pop) connections per user per IP **URL:** \ **Category:** NGINX\ **Created:** [November 1, 2010, 10:08am UTC](https://www.ruby-forum.com/t/limiting-number-of-mail-imap-pop-connections-per-user-per-ip/198431 "2010-11-01T10:08:44Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/77aa72/32.png) [@Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/u/Dobai-Pataky_BSSSSl)\ **Post date:** [November 1, 2010, 10:08am UTC](https://www.ruby-forum.com/t/limiting-number-of-mail-imap-pop-connections-per-user-per-ip/198431/1 "2010-11-01T10:08:44Z")
Hi, In real IMAP servers like Dovecot, there is a way to limit the number of connections made by a username from a particular IP. Now that nginx is going to sit in front of my dovecot - I won’t be able make use of this limit in dovecot anymore (dovecot will see only my nginxes IPs as client IP) How can I achieve this sort of limiting at the nginx level itself? -Naresh V. ---
**Author:** ![Naresh\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/c4cdca/32.png) [@Naresh\_V](https://www.ruby-forum.com/u/Naresh_V)\ **Post date:** [November 1, 2010, 11:20am UTC](https://www.ruby-forum.com/t/limiting-number-of-mail-imap-pop-connections-per-user-per-ip/198431/2 "2010-11-01T11:20:16Z")
On 1 November 2010 14:37, Naresh V [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Hi, > > In real IMAP servers like Dovecot, there is a way to limit the number > of connections made by a username from a particular IP. > Now that nginx is going to sit in front of my dovecot - I won’t be > able make use of this limit in dovecot anymore (dovecot will see only > my nginxes IPs as client IP) > > How can I achieve this sort of limiting at the nginx level itself? I see that the perl auth\_http handler can see the real client’s IP in the ‘Client-IP’ HTTP header - is there a way to forward this via IMAP/POP3 talk to the backend IMAPD/POP3D? If this were possible, I can continue to use the limits in Dovecot as-is -Naresh V. ---
**Author:** ![Naresh\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/c4cdca/32.png) [@Naresh\_V](https://www.ruby-forum.com/u/Naresh_V)\ **Post date:** [November 1, 2010, 4:35pm UTC](https://www.ruby-forum.com/t/limiting-number-of-mail-imap-pop-connections-per-user-per-ip/198431/3 "2010-11-01T16:35:27Z")
Hello! On Mon, Nov 01, 2010 at 08:17:19PM +0530, Naresh V wrote: > > > How can I achieve this sort of limiting at the nginx level itself? > > > It appears that I might have to patch nginx for supporting this. (in > > > ngx\_mail\_imap\_handler.c: in the s-\>mail\_state and s-\>command switch > > > statements) Yes, it’s non-standard and not currently supported. Probably it’s good idea to support this though. > The other approach a colleague of mine suggested was to implement a > (persistent: on-disk bdb perhaps) counter within mailauth.pm itself: > > But I’m not confident if this’d would because I’m not familiar with > the nature of operation of the mail module when it comes to the > post-auth\_http communication with the backend - does the mail > component of nginx communicate make only one connection with the > backend for a particular Auth-Status = ‘OK’ with auth\_http or more > than one? Only one (or even no one, if something goes wrong - e.g. connection fails). But you don’t have information about connection termination with auth\_http, so if you want to limit number of connections - you have to read nginx’s logs anyway. Maxim D. ---
**Author:** ![Naresh\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/c4cdca/32.png) [@Naresh\_V](https://www.ruby-forum.com/u/Naresh_V)\ **Post date:** [November 1, 2010, 3:48pm UTC](https://www.ruby-forum.com/t/limiting-number-of-mail-imap-pop-connections-per-user-per-ip/198431/4 "2010-11-01T15:48:56Z")
On 1 November 2010 15:48, Naresh V [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > > I see that the perl auth\_http handler can see the real client’s IP in > the ‘Client-IP’ HTTP header - is there a way to forward this via > IMAP/POP3 talk to the backend IMAPD/POP3D? > If this were possible, I can continue to use the limits in Dovecot as-is Dovecot’s author suggested that I look into [http://mailman2.u.washington.edu/pipermail/imap-protocol/2008-June/000872.html](http://mailman2.u.washington.edu/pipermail/imap-protocol/2008-June/000872.html) It appears that I might have to patch nginx for supporting this. (in ngx\_mail\_imap\_handler.c: in the s-\>mail\_state and s-\>command switch statements) The other approach a colleague of mine suggested was to implement a (persistent: on-disk bdb perhaps) counter within mailauth.pm itself: But I’m not confident if this’d would because I’m not familiar with the nature of operation of the mail module when it comes to the post-auth\_http communication with the backend - does the mail component of nginx communicate make only one connection with the backend for a particular Auth-Status = ‘OK’ with auth\_http or more than one? -Naresh V.