there's a logs directory under the MailRoot. You have to enable logs with either a command line option or registry setting to get the logs. I saw the login attempts in the pop3- log.
The pop3 log seems to have 6 fields: 1 - hostname 2 - domain attempting to login to 3 - ip address of client attempting login 4 - date/time 5 - user ID 6 - password (as sent - so clear text if that's how client sent password) Here's the link to starting up logging: http://www.xmailserver.org/Readme.html#command%20line You need a a value something like this: -Mr 336 -Pl -Sl -Ql -Fl -Cl -Ll That will turn on logging for all services and cycle a new log every 336 hours. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Michael Mehrle Sent: Monday, January 13, 2003 1:49 PM To: [EMAIL PROTECTED] Subject: [xmail] Re: lockout ip for bad passwords? Where are those logs located? What's the best way to monitor those logs? I have not found any xmail compatible software that would allow me to monitor thee types of activities from my Windows system at home. Michael --- "Seth A. Munroe" <[EMAIL PROTECTED]> wrote: > > Is there a setting to lock out an IP address after a > number of consecutive > failed logins? > > Someone was trying to guess passwords on my server > last week > (unsuccessfully). When I went through the logs I saw > 150 attempts in about a > 1 minute time span to guess the passwords. It tried > 10 different common > account names each with 15 common passwords. I saw > this by going through my > POP3 logs. > > What I'm looking for is a way to block logins from > an ip that has issued > more than say 5 failed logins in a row - even if > they were 5 attempts at > different accounts. It would be great if it could > have a time period set on > it too - so it just disabled it for 15 minutes for > example. > > -Seth > > > - > To unsubscribe from this list: send the line > "unsubscribe xmail" in > the body of a message to [EMAIL PROTECTED] > For general help: send the line "help" in the body > of a message to > [EMAIL PROTECTED] > __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com - To unsubscribe from this list: send the line "unsubscribe xmail" in the body of a message to [EMAIL PROTECTED] For general help: send the line "help" in the body of a message to [EMAIL PROTECTED] - To unsubscribe from this list: send the line "unsubscribe xmail" in the body of a message to [EMAIL PROTECTED] For general help: send the line "help" in the body of a message to [EMAIL PROTECTED]
