4

I am running an IBM Domino 9.0.1 (64-bit) server on a Windows Server 2008 R2.

The problem is that the IMAP server task is not displaying the IP address of the connecting client in the console and log.

Here's an example from the console log:

2016-01-08 04:13:14 nimap: edd [] authentication failure using internet password 2016-01-08 04:13:16 nimap: easter [] authentication failure using internet password 2016-01-08 04:13:19 nimap: felicity [] authentication failure using internet password

Between the brackets [] there should be the IP address. For some reason it is not being output.

In contrast, the SMTP server task displays the IP of the connecting client properly, so I don't expect it to be a DNS or similar network configuration issue.


In order to get more details, I've created an event monitor tied to this event, which runs an agent that saves the details of the event in a document. Here is one such document (displayed as a table of field names/values). As you see, it doesn't contain any useful info about the client's IP.


So, how can I get to know the IP of the connecting client without resolving to TCP monitoring tools?

TIA


P.s.: I'm aware that this is a dictionary attack.

1
  • Is it only me, or can anyone confirm that they can see the IMAP client's IP in the server log/console?
    – Sam Sirry
    Jan 14, 2016 at 11:19

1 Answer 1

0

You should be able to perform that with the "IMAP activity logging" as written here. The documentation clearly said:

"IMAP activity logging tracks IMAP session activity, such as the user name, the server name, the IP address of the client, the number of bytes the client sent to and read from the server, and the duration of the session."

Which should be what you are looking for.

2
  • From what I understand, this only works for authenticated clients. My issue is that I want to identify the IPs causing failing login attempts.
    – Sam Sirry
    Dec 1, 2016 at 20:40
  • I'll try the "Close records" option and see what it information it can provide....
    – Sam Sirry
    Dec 1, 2016 at 20:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .