[Dovecot] Alerts and pre-authenticated connections

[Timo Sirainen]

On Thu, 2007-03-15 at 15:05 +0000, Mike Brudenell wrote:
> Unfortunately starting a pre-authenticated session doesn't actually  
> create a log entry to say someone has connected or who it was, or the  
> IP address they came from (eg, in the REMOTEHOST shell environment  
> variable for an rsh session).  It would be helpful to get something  
> logged as for a normal connection, say:
> 
> dovecot: Mar 15 14:55:08 Info: imap: Login: user=<pmb1>,
>      method=PREAUTH, rip=144.32.226.226, lip=144.32.128.132
>             ^^^^^^^      ^^^^^^^^^^^^^^--- from REMOTEHOST?

One problem with this is that I don't think there's any way to get the
IP address in any standard way.

Another problem is that the logging format is in login_log_format and
login_log_format_elements settings. Those are completely handled in
imap-login/pop3-login code, so I'd have to duplicate that code to imap
binary, just for this one preauth logging message which is used by
almost no-one.

You could make a script that logs it and starts dovecot --exec-mail, or
you could write a plugin that logs it. The plugin would be pretty easy:

// gcc prelogin.c -shared -c -o prelogin.so
#include "lib.h"
#include <stdlib.h>
void prelogin_init(void) {
  i_info("Login: user=<%s> method=PREAUTH rip=%s lip=%s",
    getenv("USER"), getenv("REMOTEIP"), getenv("LOCALIP"));
}

> It seems to not be using the mail_log_prefix template which normally  
> would log the above with a timestamp and (in my customised  
> configuration file) pid:
>    dovecot: Mar 15 14:34:39 Info: IMAP(pmb1)[19021]: Disconnected:  
> Logged out

Well, OK, this I can fix:

http://dovecot.org/list/dovecot-cvs/2007-March/008178.html
http://dovecot.org/list/dovecot-cvs/2007-March/008180.html
http://dovecot.org/list/dovecot-cvs/2007-March/008181.html
http://dovecot.org/list/dovecot-cvs/2007-March/008184.html
http://dovecot.org/list/dovecot-cvs/2007-March/008182.html
http://dovecot.org/list/dovecot-cvs/2007-March/008183.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://dovecot.org/pipermail/dovecot/attachments/20070315/08ed9fb1/attachment.pgp