Bug 120368 - imapd doesn't log Login/Logout events to /var/log/maillog for LDAP users
imapd doesn't log Login/Logout events to /var/log/maillog for LDAP users
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: pam (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Tomas Mraz
Jay Turner
Depends On:
  Show dependency treegraph
Reported: 2004-04-07 23:08 EDT by Terry Griffin
Modified: 2015-01-07 19:07 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2004-11-17 06:31:17 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Terry Griffin 2004-04-07 23:08:53 EDT
Description of problem:

For users that authenticate against LDAP instead of /etc/passwd
imapd doesn't log Login/Logout events to /var/log/maillog for
IMAP or POP3 transactions. This breaks various POP-before-SMTP
authentication tools.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Configure system for LDAP authentication.
2. Create an LDAP account on the LDAP server.
3. Perform POP3 or IMAP queries for the LDAP user.

Actual results:

No ipop3d or imapd Login/Logout lines in /var/log/maillog for
the LDAP user despite a successful POP3 or IMAP transaction

Expected results:

Login/Logout lines in /var/log/maillog of the same form that
you get for /etc/password users, as in:

Apr  7 00:00:28 hostname ipop3d[23536]: Login user=username
host=remotehostname [remoteipaddress] nmsgs=0/0
Apr  7 00:00:28 hostname ipop3d[23536]: Logout user=username
host=remotehostname [remoteipaddress] nmsgs=0 ndele=0

Additional info:
Comment 1 Terry Griffin 2004-04-08 17:57:25 EDT
I found the missing log messages for LDAP users. They're going to 
/var/log/messages instead of /var/log/maillog. So now...

Actual results:

Login/Logout events are logged to /var/log/messages for
LDAP users.

Expected results:

Login/Logout events should be logged to /var/log/maillog, as
with /etc/passwd users.
Comment 2 Terry Griffin 2004-04-09 00:20:51 EDT
Some debugging of the ipop3d daemon revealed the culprit to be the
pam_authenticate() function. Prior to calling pam_authenticate() all
syslog() messages go to /var/log/maillog. After the return from
pam_authenticate() all syslog() messages go to /var/log/messages.
Comment 3 Tomas Mraz 2004-11-17 06:31:17 EST
The pam_unix module calls openlog before syslog and thus it redirects
it in case of error in the module.

This call is now removed in the upstream PAM CVS.

Note You need to log in before you can comment on or make changes to this bug.