Looking for a better way to track forwards

[rorymckinley]

I have implemented a script that uses a standardized hook (UAPI::Email::add_forwarder) to track certain details relating to the addition of a forwarder to an email account.

This is working fine, but I have come across one limitation - the data passed to my methods by the hook does not include the IP address of the actor who added the forward (I am guessing that the IP is missing because hooks can fire in a context where an IP is not present?).

As I need the IP info, I am forced to scrape the access logs to find matching entries from which I can extract an IP. This solution is less robust than I would like and so I am curious if there is a better way to get the IP address as well as the forward details?

 

[cPanelMichael]

Hello @rorymckinley,

You could integrate the LastLogin::get_last_or_current_logged_in_ip UAPI function with your script. This function returns the IP address of the cPanel user who most recently logged in.

Let me know if this helps.

Thank you.

 

[rorymckinley]

You could integrate the LastLogin::get_last_or_current_logged_in_ip UAPI function with your script. This function returns the IP address of the cPanel user who most recently logged in.

Hello @cPanelMichael - thank you for the speedy response and thank you for the pointer to LastLogin - I was not aware of it.

If I could just steal a little more of your time I would just like to confirm the behaviour of get_last_or_current_logged_in_ip() in the following scenario:

Actor A (10.0.0.1) logs in to Webmail.

A small amount of time passes and then Actor B (10.0.0.2) logs in to Webmail.

Soon afterwards, Actor A adds a forward to their mailbox.

If I was to call get_last_or_current_logged_in_ip() at this point would I be correct in assuming that it would return the IP for Actor B (10.0.0.2)?

 

[cPanelMichael]

Hello @rorymckinley,

Thank you for taking the time to provide more information. The LastLogin::get_last_or_current_logged_in_ip UAPI function is useful if you need to find the IP address of the last user to access the cPanel UI. However, the functionality of this UAPI function does not extend to Webmail.

It's not something I've personally tested, but you may want to look into using the $ip variable documented on the link below:

Guide to cPanel Variables - Developer Documentation - cPanel Documentation

Additionally, the document below offers some information on how to use hook action codes:

Guide to Standardized Hooks - The describe() Method - Developer Documentation - cPanel Documentation

Let me know if you have any questions.

Thank you.

 

[rorymckinley]

Hello @rorymckinley,

It's not something I've personally tested, but you may want to look into using the $ip variable documented on the link below:

Guide to cPanel Variables - Developer Documentation - cPanel Documentation

Thanks @cPanelMichael - that definitely looks like it would do the trick!

Sadly, I have found a wrinkle. The standardized hooks documentation states "Hook action code in a custom Perl module can access cPanel environment variables" and I have implemented it as per the docs - but I cannot get an instance of Cpanel::LiveAPI.

Looking at the code in combination with some rudimentary debugging, it appears that the failure to instantiate is caused by a missing socketfile. Is there something I should be doing to create this socketfile?

my $socketfile = $ENV{'CPANEL_CONNECT_SOCKET'} || $ENV{'CPANEL_PHPCONNECT_SOCKET'};

Side note: The documentation for the variables shows example usage as follows:

$cpliveapi->cpanelprint('$appname'});

Is the closing '}' a typo?

 

[cPanelMichael]

Hello @rorymckinley,

Upon further review, I don't believe the $ip variable is best suited for your use-case. The LiveAPI System let's you setup custom environments for applications in the cPanel interface. However, in your case, you want to fetch the Webmail user's IP address directly through the hook action code instead of the interface.

I recommend opening a feature request for the inclusion of a feature that tracks Webmail user's IP addresses:

Submit A Feature Request

In the meantime, you will likely need to implement a method for your script to obtain that IP address from /var/log/maillog.

Thank you.

 

[rorymckinley]

Hi @cPanelMichael - sorry for the long delay in answering this - I ended up down another rabbit hole. Just wanted to say thank you for the response - I will open a feature request.