1

I have a number of machines that access the same pop3 account. Does a system/server usually keep a record of when the mail account was accessed? If so what other information is usually recorded? The ip address of the machine used to access? The mac address? The mail client used?

any help much appreciated

1 Answer 1

2

This depends on a number of factors -- the server software being used (Courier, Dovecot, etc) but to answer most of your questions, and assuming this is a Linux-based mailserver:

  • Most of your informational log messages from the mail system will end up in /var/log/mail.info, /var/log/maillog, or /var/log/messages.

  • Note that a lot of this is also dependent on the syslog daemon on the mail server itself, as to where the information ends up.

  • The POP3 protocol doesn't allow a client to identify itself outside of the protocol scope (i.e. there is no User-Agent string a la Apache access logs), IIRC.

  • The MAC address wouldn't mean anything in this scenario.

  • Any errors or other failures will be recorded as well, perhaps with more clarity depending on the logging options you have set.

Generally, you can retrieve the time the account was accessed (and with what login), and hte remote/local IP addresses used to do so. Here's an example line from a Dovecot login event:

Nov 30 18:20:46 SCSIServer dovecot: pop3-login: Login: user=<user2>, 
method=PLAIN, rip=192.168.1.115, lip=192.168.1.199

Depending on the level of verbosity you need, you can adjust Dovecot's auth* parameters as well. I chose Dovecot because it is a common deployment, however, check your mailserver's documentation for more. If this is Exchange or another Windows service, start looking in whatever the appropriate event log is.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .