[SOLVED] pop before smtp authentication

[sady]

This is string for nginx.log (for Zimbra Proxy server)

$PID_pat = '(\d+\/\d+\/\d+\ \d+\:\d+\:\d+) \[info\] \d+\#\d+\: \*(\d+) ';
$IP_pat = $PID_pat . 'client (\d+\.\d+\.\d+\.\d+) connected to .*';
$OK_pat = $PID_pat . 'client logged in, client: \d+\.\d+\.\d+\.\d+\, server: \d+\.\d+\.\d+\.\d+\:\d+';

[marnellej]

Originally Posted by simgar

Due to out zimbra implementation being a migration from an existing server with hundreds of users all using pop-before-smtp, we were require to enable this tool as well. Everything from the mnxsolutions blog posting above worked fine except that the INFO multiline authentication patterns did not catch IMAP logins, so we changed them to the following and everything appears to be working correctly, both POP3 and IMAP:

$PID_pat = '^[LOGTIME],\d+\ INFO \[(?:Pop3|Imap)[A-Za-z]+-(\d+)\] ';
$IP_pat = $PID_pat . '[\S\s]+(?:\[|=)(\d+\.\d+\.\d+\.\d+)[\S\s]+ connected';
$OK_pat = $PID_pat . '[\S\s]+name=[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4}[\S\s]+(?op|imap) \- user [A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4} authenticated, mechanism=[A-Za-z]+';

Can anyone update the regex for
Release 7.1.1_GA_3196.UBUNTU10_64 UBUNTU10_64 FOSS edition.

[marnellej]

Still waiting for any assistance on this