Issue imap-login remote IP not logged

[zoni]

Hi,

I have several failed imap logins in maillog however I can not see the remote IP, what I see is this:

dovecot: imap-login: Login: user=<[email protected]>, method=CRAM-MD5, rip=127.0.0.1, lip=127.0.0.1

I have centos 7. How can I log the real remote IPs?

I know these logins attempts are remote and not from the installed webmail, kolab premium.

 

[Ksech]

Same question. I found the following which I thought might help a little if I was actually looking when they logged in, but it appears that mail logins are no longer possible to view here either - so from what I can tell, there is NO way to retrieve the IP address of a webmail login???

Monitoring Connections to Plesk

Monitoring User Sessions To find out who of your customers is logged in to Plesk at the moment: Go to Tools & ...

docs.plesk.com

 

[Compy]

Any solution to this today?

 

[Monty]

If you see remote ip ("rip") and local ip ("lip") as 127.0.0.1 then those are webmail (Roundcube or Horde) logins.

You should see the failed logins along with their real IP in /var/log/plesk-roundcube/errors or /var/log/psa-horde/psa-horde.log

 

[Compy]

Thanks for the fast reply. Mail Log Browser still have the wrong ip in the logs of customers, sorry forgot to include it in my previous post.​

 

[mow]

Thanks for the fast reply. Mail Log Browser still have the wrong ip in the logs of customers, sorry forgot to include it in my previous post.​

It is not the wrong IP.
Mail log shows what the mail server sees, and if that is a login from webmail, it sees a connection from the webmail daemon, which is running on and thus connecting from the same server, not from the user's browser (webmail is not a javascript client!). So it shows the server's IP.
As Monty already wrote, to see the user's IP, you need to check the webmail server logs.