Issue imap-login remote IP not logged

[zoni]

Hi,

I have several failed imap logins in maillog however I can not see the remote IP, what I see is this:

dovecot: imap-login: Login: user=<xxxxx@xxxxxx.com>, method=CRAM-MD5, rip=127.0.0.1, lip=127.0.0.1

I have centos 7. How can I log the real remote IPs?

I know these logins attempts are remote and not from the installed webmail, kolab premium.

 

[Ksech]

Same question. I found the following which I thought might help a little if I was actually looking when they logged in, but it appears that mail logins are no longer possible to view here either - so from what I can tell, there is NO way to retrieve the IP address of a webmail login???

Monitoring Connections to Plesk

Monitoring User Sessions To find out who of your customers is logged in to Plesk at the moment: Go to Tools & ...

docs.plesk.com

 

[Compy]

Any solution to this today?

 

[Monty]

If you see remote ip ("rip") and local ip ("lip") as 127.0.0.1 then those are webmail (Roundcube or Horde) logins.

You should see the failed logins along with their real IP in /var/log/plesk-roundcube/errors or /var/log/psa-horde/psa-horde.log

 

[Compy]

Thanks for the fast reply. Mail Log Browser still have the wrong ip in the logs of customers, sorry forgot to include it in my previous post.​

 

[mow]

Thanks for the fast reply. Mail Log Browser still have the wrong ip in the logs of customers, sorry forgot to include it in my previous post.​

It is not the wrong IP.
Mail log shows what the mail server sees, and if that is a login from webmail, it sees a connection from the webmail daemon, which is running on and thus connecting from the same server, not from the user's browser (webmail is not a javascript client!). So it shows the server's IP.
As Monty already wrote, to see the user's IP, you need to check the webmail server logs.

 

[Compy]

Still no logs on imap connection today?

 

[Sebahat.hadzhi]

If you see remote ip ("rip") and local ip ("lip") as 127.0.0.1 then those are webmail (Roundcube or Horde) logins.

You should see the failed logins along with their real IP in /var/log/plesk-roundcube/errors or /var/log/psa-horde/psa-horde.log

@mow explanation on why the mail log shows the local IP rather than the user IP is pretty good.

 

[JVG]

You can enable user logins log to webmail: https://support.plesk.com/hc/en-us/...le-additional-webmail-logging-on-Plesk-server (it doesn't do anything to the mail log, it creates its own separate userlogins log)

I still think there should be an option in Plesk to do this (there isn't), or at least have it enabled by default (it isn't).

 

[Kaspar]

You can enable user logins log to webmail: https://support.plesk.com/hc/en-us/...le-additional-webmail-logging-on-Plesk-server (it doesn't do anything to the mail log, it creates its own separate userlogins log)

I still think there should be an option in Plesk to do this (there isn't), or at least have it enabled by default (it isn't).

To avoid any confusion I like to add that this creates an additional log in which all Roundcube login attempts are logged. This can be useful of course. But failed login attempts are already logged by default (and without the need of any custom configuration) in the /var/log/plesk-roundcube/errors file.