Re: [courier-users] Log SMTP Auth

2016-08-22 Thread Sam Varshavchik

Bernd Wurst writes:


Hi.

I just wondered if there is any built-in way to have courier mail server
log Authentications (successful and unsuccessful) in a clean and simple way.

In esmtpd config, I can log the dialog, in authdaemonrc I can turn on
debugging but that's clearly not an easy way to have authentications
logged. Auth failures get logged as errorneous SMTP response but I did
not find anything about successful logins.

Any idea on that?


The only logging options are the ones that can be set in authdaemonrc, and  
in maillog.



I would like to build some heuristic detection about hacked accounts.
Not really rate limiting but something "alert me when an account logged
in a hundred times in a few minutes".


A single successful authentication is sufficient to send an unlimited number  
of emails. SMTP allows multiple emails to be sent for a single connection.





pgpcwUF3oPjdz.pgp
Description: PGP signature
--
___
courier-users mailing list
courier-users@lists.sourceforge.net
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users


Re: [courier-users] Log SMTP Auth

2016-08-22 Thread Jérôme Blion
Hello,

I think you could use courier-pythonfilter and create a new logging 
filter based on whitelist_auth.

HTH.
Jerome Blion.

--
___
courier-users mailing list
courier-users@lists.sourceforge.net
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users