How display lastest access attempt to mailbox ?

[seba22]

Welcome,


I need to print out last try of access attempt to mailbox, for example xxx@domain.com.

I need successful and unsuccessful with date and IP.
(access was granted by webmail)


Any idea how do this ?

Regards

[bdial]

i'd look in /opt/zimbra/log/audit.log

not sure if you'll find exactly what you're looking for. it may log an unsuccessful attept but may not tell you which mailbox it was trying im not sure but thats where logins and stuff are logged

[seba22]

Thank you for reply, but i find thats not a hacker attempt.


I will start from beginning.

Yesterday, i got phone from one of my users with information "someone read my e-mails".

He said:

I got few mails at night, i log into my pc and they are opened (mark as read)..

(so i was thinking hacker should be stupid, because he can use right click and mark them as unread) but, there is no time to waste...

I reset his password, and try find answer in log files.
Then i post message on this board.


I think my installation is very secure, (mail server stand in NAT, dont have public IP, have forwarded only few ports (smtp and XMPP), webmail is going by proxy on webserver using https.

So it looks secure and it was make me very interested whats happen.

I cant see anything suspicious, but for own security i change also my password.
When i logged in, i just realize that somethings wrong with my e-mails also.. but... not..

They are marked as non read on left side in (x new messages), but not bold... previous all unread messages looks like this text. after few seconds drop bold, and everybody know "it was read" .





On left side you can see how much e-mails are not read, but they aren't marked using bold font, like usually thing happen.

I have try using all themes and browsers (firefox, chrome, opera).


Anyone have idea what's going wrong ?
Yesterday i had even try reinstall Zimbra, but it won't help...

2 days back, it working great, yesterday stop...
All users have same problem...