1

I successfully set up nginx imap/pop3 mail proxy with auth_http which has been working fine for months. Recently came up a request on showing client's IP in mail.log at imap logins.

Since Nginx communicates with Dovecot the IP address in log belongs to Nginx server (which in this case 127.0.0.1 - as they are on the same server).

So far I could not find a solution or workaround for that. Apparently not even logging is possible in nginx mail block.

The closest hit was a HAProxy support in Dovecot (https://wiki2.dovecot.org/HAProxy) but I am not sure there is similar to Nginx.

Any help is appreciated.

Thanks

  • I'm not sure whether this also works when using nginx as an IMAP proxy (nor do I actually know how Dovecot itself transfers the client IP when used as a proxy), but you have to configure the proxy as trusted network: "Set login_trusted_networks to point to the proxies in the backends. This way you'll get the clients' actual IP addresses logged instead of the proxy's." – Jens Erat Aug 22 '17 at 15:31
  • Thanks Jens, in my understanding it applies when Dovecot does the proxying and login_trusted_networks contains the IP of the remote server, but here Dovecot IS the remote server. – Czollli Aug 23 '17 at 10:26
  • No, login_trusted_networks is required to contain the proxy server in the backend server's configuration. There are different effects: no login penalties for users behind the proxy (Dovecot counts per IP, thus a single user might lock out the whole user base behind the proxy, also an issue for large NAT networks), and especially of interest in your case: Dovecot does print the actual client IP instead of the proxy IP for several outputs; I'm not sure though how the client IP is transmitted and whether Nginx is doing so. – Jens Erat Aug 23 '17 at 20:20
  • Thanks to clarify, I misread the doc. I tweaked Nginx's proxy script to pass client's IP to Dovecot using your suggested config pointing back to Nginx however does not seem to work. Probably Nginx is not prepared to transfer client's IP properly. I found a workaround though amending the script, filtering and recording necessary bits to a different log file. Not the expected solution but works for now. – Czollli Sep 8 '17 at 10:01
  • 1
    @Czollli please post your solution as an answer. It is perfectly fine to answer your own question and accept it. – Gerald Schneider Sep 12 '17 at 9:47
1

Workaround

Not finding suitable solution I rather created a new log file in the proxy script which provided a acceptable solution to the request.

Here is the excerpt:

$fp = fopen('/var/log/mail_logins.log', 'a');
$now = "[" . (new \DateTime())->format('Y-m-d H:i:s') . "]";
fwrite($fp, $now . " HTTP_AUTH_PROTOCOL: " . $_SERVER["HTTP_AUTH_PROTOCOL"] . ", HTTP_AUTH_USER: " . $_SERVER["HTTP_AUTH_USER"] . ", HTTP_CLIENT_IP: " . $_SERVER["HTTP_CLIENT_IP"]. "\n");
fclose($fp);

It might help someone.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.