Zimbra-Community / account-history

A Zimbra extension that allows the user to monitor their recent login and account activity. This is important to keep the user's account safe.
GNU General Public License v2.0
21 stars 2 forks source link

zsync IP is not logged in audit.log and not in webUI #10

Closed d1907 closed 6 years ago

d1907 commented 6 years ago

zsync IP is not logged in audit.log and not in webUI

no mobile ip ????

barrydegraaff commented 6 years ago

Yeah, the problem here is that Zextras Mobile logs in the wrong logfile, aka sync.log where usually a lot of stacktraces are logged as well.

The audit.log where the log should be, does not contain the IP.

I contacted the upstream devs, but they as of yet did not fix it.

See also https://github.com/Zimbra-Community/account-history/issues/1

I contacted the devs yet again, in the mean time you can and the sync.log to your config, https://github.com/Zimbra-Community/account-history#configuring-preferences

It will be a bit ugly, but I will look into a work-around

d1907 commented 6 years ago

123 added to configuration file config.properties audit_logs=/opt/zimbra/log/audit.log;/opt/zimbra/log/sync.log

It began to open long But still there is no IP (((

d1907 commented 6 years ago

The difference in the log file is only webclient oip=11.1.1.1 mobile (zsync) ip=11.1.1.1

barrydegraaff commented 6 years ago

you have no oip, check https://github.com/Zimbra-Community/account-history#log-external-ip

d1907 commented 6 years ago

zimbra@mail:/$ zmlocalconfig zimbra_http_originating_ip_header zimbra_http_originating_ip_header = X-Forwarded-For zimbra@mail:/$

cat /opt/zimbra/log/audit.log

/service/soap/AuthRequest] [name=surikovm@xxxxxxx;oip=x.x.x.x;ua=zclient/8.7.11_GA_1854;] security - cmd=Auth; account=

Microsoft-Server-ActiveSync?User=shatrova&DeviceId=ApplF18K9J4VDTWF&DeviceType=iPhone&Cmd=Ping] [ip=x/x/x/x;] security - cmd=Auth

barrydegraaff commented 6 years ago

ip = should be an internal ip (without proxy, not supported) oip = should be an external ip (ip passed from proxxy)

Yah, that is a the bug in zextras.... I ask again if the devs are going to fix it, otherwise I will create a work-around tomorrow

barrydegraaff commented 6 years ago

Added support for reading protocol from sync.log new