Browse Source
Proposal: Log the Login Success/Failure Log Messages in a JSON-readable fashion. Rationale: fail2ban most likely never bans localhost. Localhost is trusted. However, in many installations, Dovecot (or another userauth subsystem) will log Roundcube logins as originating from the machine Roundcube runs on, probably localhost. Failed logins thru Roundcube thus result in being mistakenly considered as originating from "localhost" — which of course is not true, considering only Roundcube itself knows the true origin of the failed login attempt (`rcube_utils::remote_ip()`). This change request patches rcmail.php to write more `grep` and other machine-parse-friendly log messages, allowing for simpler extension of whatever fail2ban-like attack counter measures are in place. With this, one could even configure rsyslog to create own log files for Roundcube auth failures, based on the simple string `RC_LOGIN:FAILURE:` introduced here, again making it much easier for fail2ban to look in the right places. Example rsyslog config snippet (of course, RC needs to be configured to log to syslog): ``` if $programname contains 'roundcube' then { if ($msg contains 'RC_LOGIN:FAILURE:') then { -/var/log/mail.err & stop } } ```pull/8460/head

committed by
GitHub

1 changed files with 13 additions and 5 deletions
Loading…
Reference in new issue