Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

mail password logs

Discussion in 'E-mail Discussion' started by caelim, Nov 12, 2009.

  1. caelim

    caelim Registered

    Joined:
    Nov 12, 2009
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    51
    cPanel 11.25.0-C40255 - WHM 11.25.0 - X 3.9
    CENTOS 5.3 i686

    I am currently running the above version of cpanel and came across a problem whereby one of our clients passwords for their mail account changed. Is there a log kept of who and when a mail password was changed? I have searched the forums but only came accross access logs for cpanel but none specifically for mail passwords.

    Any suggestions on where to look would be appreciated!!
     
  2. cPanelDon

    cPanelDon cPanel Quality Assurance Analyst
    Staff Member

    Joined:
    Nov 5, 2008
    Messages:
    2,554
    Likes Received:
    9
    Trophy Points:
    168
    Location:
    Houston, Texas, U.S.A.
    cPanel Access Level:
    DataCenter Provider
    Twitter:
    Using the access_log it is possible to locate entries where a user logged-in via cPanel Webmail accessed the change password feature by searching for keywords in the URI or the HTML form action:

    Here are two example keywords that could be searched for:
    passwdpop
    dopasswdpop

    Here is an example command that could be used via root SSH access:
    Code:
    # grep -i "passwdpop" /usr/local/cpanel/logs/access_log
    To narrow the search to only entries matching the HTML form action:
    Code:
    # grep -i "dopasswdpop" /usr/local/cpanel/logs/access_log
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. caelim

    caelim Registered

    Joined:
    Nov 12, 2009
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    51
    thx a million

    I had a look the logs for when the password was changed and tried comparing it to the maillog to see when the first login was unsucessful but unfortunately the logs get rotated and it doesn't stretch back far enough for me to pinpoint it. I will just have to wait for the problem to re-occur to find out exatly what happened . Thanks for the assistance..it is much appreciated tho!
     
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice