I don't suppose there is a handler already for this one? Yes, that would have been the best to also add a warning system in case of unauthorized IP access.

On 12/11/2021 20:00, Sebastian Nielsen wrote:

If yore gonna check for IP, you should do it in pre-login so you can reject the username/password combo if the registred IP of account does not match.

But guess its better to write a custom login handler for that, that also checks user's ip against database, in addition to username/password, and tells client username/password is wrong if IP is unauth..

-------- Originalmeddelande -------- Från: Lefteris Tsintjelis <lefty@spes.gr> Datum: 2021-11-12 18:48 (GMT+01:00) Till: dovecot@dovecot.org Ämne: IPv4/v6 based access checking and logging

Hi,

I am currently using postfix/dovecot with postfix admin and I track the last login date already by using this:

https://doc.dovecot.org/configuration_manual/lastlogin_plugin/

Besides last login date, I would like to also implement IPv4 and IPv6 last login tracking also and if possible, IP based login checking. Is post-login scripting the best most efficient way to go?

Regards,

Lefteris

And a litle shell script to query data from db:

#!/bin/sh ######################################################################################### # ex.: uso: dovecotLastLogin.sh -d 10 #       dovecotLastLogin.sh -u julio ######################################################################################### # For Mysql postfixadmin database ######################################################################################### MYSQL="mysql --login-path=vmail -Dvmail -t -e" case $1 in -d) DAYSAGO=date --date="$2 days ago" +%s $MYSQL "select username,last_login.domain,FROM_UNIXTIME(last_login) AS last_login,rip,proto,active FROM last_login INNER JOIN mailbox USING (username) WHERE last_login < '$DAYSAGO' ORDER BY mailbox.active,last_login;" ;;

        -u) $MYSQL "select username,last_login.domain,FROM_UNIXTIME(last_login) AS last_login,rip,proto,active FROM last_login INNER JOIN mailbox USING (username) WHERE username LIKE '%$2%' ORDER BY mailbox.active,last_login;" ;;

        *) echo echo " USO: dovecotLastLogin.sh [-d -u] [days user]" echo echo " -d --> All users whith no login in N days ago, ex.: dovecotLastLogin.sh -d 90" echo " -u --> Last login from user, ex.: dovecotLastLogin.sh -u user@domain.com" echo " List last login from ALL users from one domain: dovecotLastLogin.sh -u domain.com" echo " List lat login from ALL users: dovecotLastLogin.sh -u %" exit 1 ;; esac # End

 _    Engº Julio Cesar Covolato
0v0   <julio@psi.com.br>

/(_)\ F: 55-11-99175-9260 ^ ^ PSI INTERNET

Em 12/11/2021 15:33, julio covolato escreveu:

Em 12/11/2021 14:47, Lefteris Tsintjelis escreveu:

...

Hi,

I am currently using postfix/dovecot with postfix admin and I track the last login date already by using this:

https://doc.dovecot.org/configuration_manual/lastlogin_plugin/

Besides last login date, I would like to also implement IPv4 and IPv6 last login tracking also and if possible, IP based login checking. Is post-login scripting the best most efficient way to go?

Regards,

Lefteris

Hi,

This is my lastlogin config to track remote ip:

dovecot.conf:

dict {

  lastlogin = mysql:/etc/dovecot/dovecot-last-login.conf .... }

dovecot-last-login.conf:

connect = host=127.0.0.1 port=3306 dbname=vmail user=vmailadmin password=XXXXXXXXXXXXXXX

map { pattern = shared/last-login/$user/$domain/$rip/$service table = last_login value_field = last_login value_type = uint

    fields { username = $user domain = $domain rip = $rip proto = $service } }

Mysql table last_login:

+------------+--------------+------+-----+---------+-------+ | Field      | Type         | Null | Key | Default | Extra | +------------+--------------+------+-----+---------+-------+ | username   | varchar(255) | NO   | PRI |         |       | | domain     | varchar(255) | NO   | MUL |         |       | | last_login | int(11)      | YES  | MUL | NULL    |       | | rip        | varchar(16)  | NO   | MUL |         |       | | proto      | varchar(10)  | NO   |     | NULL    |       | +------------+--------------+------+-----+---------+-------+

Hope this help!

---

    _    Engº Julio Cesar Covolato 0v0   <julio@psi.com.br> /(_)\  F: 55-11-99175-9260 ^ ^   PSI INTERNET

Hi Lefteris.

Say thank you to Aki Tuomi, he was the one who taught me all this!! That's the spirit of opem sourse!

 _    Engº Julio Cesar Covolato
0v0   <julio@psi.com.br>

/(_)\ F: 55-11-99175-9260 ^ ^ PSI INTERNET

Em 12/11/2021 18:43, Lefteris Tsintjelis escreveu:

Exactly what I was looking for and the script as well! Thank you very much Julio

On 12/11/2021 20:33, julio covolato wrote:

...

Em 12/11/2021 14:47, Lefteris Tsintjelis escreveu:

...

Hi,

I am currently using postfix/dovecot with postfix admin and I track the last login date already by using this:

https://doc.dovecot.org/configuration_manual/lastlogin_plugin/

Besides last login date, I would like to also implement IPv4 and IPv6 last login tracking also and if possible, IP based login checking. Is post-login scripting the best most efficient way to go?

Regards,

Lefteris

Hi,

This is my lastlogin config to track remote ip:

dovecot.conf:

dict {

   lastlogin = mysql:/etc/dovecot/dovecot-last-login.conf .... }

dovecot-last-login.conf:

connect = host=127.0.0.1 port=3306 dbname=vmail user=vmailadmin password=XXXXXXXXXXXXXXX

map { pattern = shared/last-login/$user/$domain/$rip/$service table = last_login value_field = last_login value_type = uint

     fields { username = $user domain = $domain rip = $rip proto = $service } }

Mysql table last_login:

+------------+--------------+------+-----+---------+-------+ | Field      | Type         | Null | Key | Default | Extra | +------------+--------------+------+-----+---------+-------+ | username   | varchar(255) | NO   | PRI |         |       | | domain     | varchar(255) | NO   | MUL |         |       | | last_login | int(11)      | YES  | MUL | NULL    |       | | rip        | varchar(16)  | NO   | MUL |         |       | | proto      | varchar(10)  | NO   |     | NULL    |       | +------------+--------------+------+-----+---------+-------+

Hope this help!

---

     _    Engº Julio Cesar Covolato 0v0   <julio@psi.com.br> /(_)\  F: 55-11-99175-9260 ^ ^   PSI INTERNET