"Hubbard, David" wrote:
>
> Hi all,
> does sqwebmail use vchkpw for it's authentication?
> Or does it handle things itself? I'm wondering
> because I'd really like to have a log of my users
> logging in to check their mail from the web, what
> IP address they're on, and failures. I'm curious
> whether sqwebmail does it's own thing or uses
> vchkpw, and depending on that answer, I'd like to
> request authentication logging be added as a feature
> to the appropriate one? I don't care how, syslog,
> text file, etc. :-)
>
> Thanks,
>
> Dave
Sqwebmail has alot of available options to doing
authentication. Mr Sam has built a nice method
of integrating authentication methods. One of
them is vpopmail.
I was talking yesterday about sqwebmail logging
information. And where to place it. With the
current setup, sqwebmail doesn't log anything
and the vpopmail library functions used don't
log anything either.
I'm thinking it would be a bad idea to place
logging code inside the vpopmail library functions
with provide authentication.
Maybe a better place would be to add logging code
into sqwebmail, in the places where it calls
the vpopmail code.
It would be fairly easy. In sqwebmail source
code, go into the authlib directory and
edit the preauthvchkpw.c file.
Search for pw=vauth_getpw(usercopy, s); line.
This is the only vpopmail function needed
for authentication.
Just after this call add:
openlog("sqwebmail",LOG_PID,LOG_MAIL);
then format a mess string and call
syslog( LOG_INFO, mess);
closelog();
If you want to be security concious, check the
formated string before passing it to syslog with:
for(i=0;mess[i]!=0;++i) if (mess[i]=='%') mess[i]='#';
Cheers
Ken Jones
