I would like to find a way to map account access to ip addresses.
The situation is that I believe there are multiple sources accessing the same account via pop3. I want to see the ip addresses that are connecting to a specific account via a protocol.
This is on a RHEL Box with QMail.
If there is not a log that contains this information, I would be interested in any type of plugin or addition that could log these statistics.
It depends what you're using as your POP server on the qmail host. If qmail-pop3d, then solutions such as vpopmail (www.inter7.com) can provide this. Authentication logs that this raises looks like (suitably anonymised of course :-) ):
Aug 5 00:02:28 smurf vpopmail[2098]: vchkpw-pop3: (PLAIN) login success justin.time@mail.solutions.co.uk:76.143.83.209
Aug 5 00:02:31 smurf vpopmail[2100]: vchkpw-pop3: (PLAIN) login success c.nyle@mail.digby.co.uk:56.176.132.101
Aug 5 00:02:32 smurf vpopmail[2102]: vchkpw-pop3: (PLAIN) login success p.spoor@mail.digby.co.uk:56.176.176.70
