simonrob / email-oauth2-proxy

An IMAP/POP/SMTP proxy that transparently adds OAuth 2.0 authentication for email clients that don't support this method.
Apache License 2.0
797 stars 86 forks source link

Feature Request: logging of client IP in standard logs #196

Closed deepjansari closed 10 months ago

deepjansari commented 11 months ago

Hi,

I am running the proxy on Linux with --no-gui mode and everything is working fine and it's great however wanted to see some of the below options are possible by any chance.

  1. Logging of client IP address in the standard logs (currently it only logs the username)
  2. Enable debug mode without killing the process and starting again
  3. Reload config file without killing the process and starting again

The last 2 options are present with GUI and want to see if same can be done with --no-gui option.

Thank you!

simonrob commented 11 months ago

Hi - thanks for these suggestions.

  1. Logging of client IP address in the standard logs (currently it only logs the username)

The standard non-debug log output already displays the proxy's local address as set up in the config file, and the debug log just expands this to show the eventual local port and remote server address. When you're running the proxy on the same system as the email client, showing its address would be a bit meaningless. Do you mean the remote client address in the case that you're using the proxy on a public server?

  1. Enable debug mode without killing the process and starting again

From memory this may have been suggested before, but I can't find the discussion right now (it'll be in a GitHub issue). How would you suggest this is achieved?

  1. Reload config file without killing the process and starting again

This is already possible on macOS and Linux by sending SIGHUP – for example, pkill -SIGHUP -f emailproxy.py. I'm open to suggestions about how to achieve this on Windows if needed.

deepjansari commented 11 months ago

Hello,

Thank you for quick response! :)

1) Yes, I mean the remote client address as I am running the proxy on separate server 2) Sorry, I am new to Python hence can not suggest on this 3) Thank you for providing SIGHUP example. This is exactly what I needed.

simonrob commented 11 months ago

I think the debug mode toggle is a useful idea, so have added it in 5f833955f36c1a7ef5a1f3a6426f3d48917533eb. Toggle modes by sending SIGUSR (e.g., via pkill -USR1 -f emailproxy.py).

The client address could be printed fairly easily when clients first connect, but providing this for every log line as is currently done with the server address(es) would require more effort. Would a message on a new connection be useful? (i.e., as part of the New incoming connection to IMAP server at XXX or related log lines)

deepjansari commented 11 months ago

Thanks for update. Debug mode - I tested the "pkill -SIGUSR1 -f emailproxy.py" and "pkill -USR1 -f emailproxy.py" with new proxy and seems the whole proxy process is just getting killed. Would there be also an option to disable debug mode (e.g. in scenario after troubleshooting is done and debug mode is no longer needed)

Client address - Yes, in my view when client first connect should be enough to have address for audit purpose. Also, it would be nice to have client address printed for failed login attempts.

simonrob commented 11 months ago

Thanks for testing this – I use the macOS version (which works); the Linux version had a typo, which is fixed in 73f7d8aa44d7404d9a7a3a6f7e9b3f6388c956fc. Sending the signal toggles debug mode, so yes, you can disable it when you don't need it any more.

If I get time, I'll see whether the client address can be printed.

deepjansari commented 11 months ago

Thanks, I have tested debug toggle on Linux and all works fine!!

simonrob commented 11 months ago

36a8e8dc1de5e33f63424bf4bcc1fdaf92879e91 adds full connection details to the debug log, making it clearer which is the client, proxy and remote server address.