Description

For deployment requirements, we need Guam to log the source IP address and username of the client connecting to IMAP.

We need to get these on the info level.

I can see how it would also be useful to log failed authentication attempt's (provided) username and source IP address, but that is of a later concern.

Details

Ticket Type: Task

Related Objects
Search...

		Status	Assigned	Task
				Restricted Maniphest Task
		Open	mollekopf	T1197 Log username and source IP address

Event Timeline

vanmeeuwen created this task.Apr 12 2016, 3:35 PM

vanmeeuwen added a parent task: Restricted Maniphest Task.Apr 12 2016, 3:39 PM

petersen added a project: Sprint 201616.Apr 18 2016, 7:50 AM

petersen added a project: Sprint 201617.Apr 25 2016, 9:02 AM

petersen added a project: Sprint 201618.May 2 2016, 8:56 AM

petersen added a project: Sprint 201619.May 9 2016, 9:17 AM

petersen added a project: Sprint 201620.May 16 2016, 8:51 AM

petersen added a project: Sprint 201621.May 23 2016, 9:05 AM

petersen added a project: Sprint 201622.May 30 2016, 10:33 AM

petersen added a project: Sprint 201623.Jun 6 2016, 9:57 AM

petersen added a project: Sprint 201624.Jun 13 2016, 9:53 AM

petersen added a project: Sprint 201625.Jun 20 2016, 10:34 AM

petersen added a project: Sprint 201626.Jun 27 2016, 10:41 AM

petersen added a project: Sprint 201627.Jul 4 2016, 7:12 AM

petersen added a project: Sprint 201628.Jul 11 2016, 9:08 AM

petersen added a project: Sprint 201630.Jul 25 2016, 9:06 AM

petersen added a project: Sprint 201632.Aug 8 2016, 8:02 AM

petersen edited projects, added Sprint 201633; removed Sprint 201632.Aug 8 2016, 8:49 AM

petersen added a project: Sprint 201634.Aug 22 2016, 8:52 AM

Should be implemented as a rule.

• seigo moved this task from Backlog to Pending on the Guam board.Dec 13 2016, 2:01 PM

I also miss this feature as this would enable log based intrusion detection/prevention on IMAP accounts. Cyrus logs are only logging 127.0.0.1 as client IP because of Guam proxying, and Guam is not logging authentication events with IP.

pasik subscribed.Nov 25 2017, 2:40 PM

Up?

vanmeeuwen lowered the priority of this task from 60 to Normal.Mar 28 2019, 8:12 AM

mollekopf claimed this task.May 18 2021, 8:59 AM

mollekopf added a subscriber: • seigo.