ok people
thanks for the patience & sorry for bothering
i always thought those messages had to do with mail being delivered via smtp
or something
guess i was wrong, was looking but didn't see ;)
is it also possible to see for what domain the password failed?
currently i only see "password fail <user> from <ip>" and not "password fail
<ip>@<domain> from <ip>"
password fail %s@%s from %s ?
best regards!
-- jmr
----- Original Message -----
From: "iv0" <[EMAIL PROTECTED]>
To: "J.M. Roth (iip)" <[EMAIL PROTECTED]>
Cc: "Stefan Paletta" <[EMAIL PROTECTED]>; "'qmail list'"
<[EMAIL PROTECTED]>; "Jim Zajkowski" <[EMAIL PROTECTED]>; "VCHKPW LIST"
<[EMAIL PROTECTED]>
Sent: Saturday, January 15, 2000 4:29 AM
Subject: Re: pop3 and ip adres logging
>
> in vchkpw.c
> struct passwd *checkpopusers(char *login, char *passwd, char *apop)
>
> Line 129:
> if ( ENABLE_LOGGING == 1 )
> syslog(LOG_INFO,"virtual %s@%s from %s", login,host, IpAddr);
>
> ENABLE_LOGGING is in config.h defined by configure options
>
> ./configure --enable-logging
>
> Also in checkrealuser:
> syslog(LOG_INFO,"real %s for %s from %s",buf,name,IpAddr);
>
>
> and in main()
> Line 252
> log_exit(LOG_NOTICE, 3, "vchkpw: No user found [%s] from
> %s",
> name, IpAddr);
>
> Ken Jones
> http://www.inter7.com/qmail/
>
> "J.M. Roth (iip)" wrote:
> >
> > Hi there,
> >
> > getting back to an earlier discussion,
> >
> > I still haven't found out how to log the username (and perhaps the
> > passwords) that have been tried on successful AND mostly on UNsuccessful
> > logins.
> > Tried --enable-logging=y, tried several wrappers (see below).
> > I'm using vpopmail3.4.11 as the POP package.
> > Where is the username used in qmail-popup stored after I entered it??
File?
> > Variable? Help!
> >
> > Regards !
> >
> > -- jmr
> >
> > Van Liedekerke Franky <[EMAIL PROTECTED]> wrote on Thu,
13
> > Jan 2000:
> > > This probably works, but I'm using tcpserver and multilog, so how can
I
> > > achieve this kind of logging using those tools?
> > *************Mostly, I'd like to
> > *************know how to log all of the POP connections, not just the
> > successfully
> > *************authenticated ones. In case someone tries to crack the
> > passwords or
> > *************something like that.
> >
> > I'm curious about this as well. I'm still using inetd for POP, but I'm
> > planning to migrate over to tcpserver sometime.
> >
> > ----- Original Message -----
> > From: "iv0" <[EMAIL PROTECTED]>
> > To: "Stefan Paletta" <[EMAIL PROTECTED]>
> > Cc: "'qmail list'" <[EMAIL PROTECTED]>
> > Sent: Thursday, January 13, 2000 7:21 PM
> > Subject: Re: pop3 and ip adres logging
> >
> > > Stefan Paletta wrote:
> > > >
> > > > Van Liedekerke Franky wrote/schrieb/scribsit:
> > > > > does anybody know a quick hack to log the ip adres in a pop3
session
> > without
> > > > > setting tcpserver to verbose mode?
> > > >
> > > > # cat /var/qmail/bin/qmail-pop3d-log
> > > > #!/bin/sh
> > *********> > logger -p local2.info -t pop3d "$USER logged in from
> > $TCPREMOTEIP [$TCPREMOTEHOST]"
> > *********> > exec /var/qmail/bin/qmail-pop3d $1
> > > > #
> > > >
> > > > Stefan
> > > >
> > >
> > > The vpopmail vchkpw program does that.
> > > http:/www.inter7.com/vpopmail
> > >
> > > Ken Jones
> > >
>
