[nflug] need idea
Cyber Source
peter at thecybersource.com
Mon Feb 20 12:22:53 EST 2006
Mark Musone wrote:
> Why not just have them to go a url on your web site?
>
> from there you'll know their ip address, and they can even do more stuff
> (open up a service ticket, or it can even automatically add their ip address
> into your email/firewall/whatever settings.
>
> or if you already have access to their machines, setup a cron job that runs
> wget to a specific url on your site. again, I'd go the web/url way. I
> wouldn't screw around with dealing with and parsing email and tracking down
> mail relays and the such. too fugly..
>
> ..Just my $.02
>
> -Mark
>
>
> -----Original Message-----
> From: nflug-bounces at nflug.org [mailto:nflug-bounces at nflug.org] On Behalf Of
> Cyber Source
> Sent: Monday, February 20, 2006 12:14 PM
> To: nflug at nflug.org
> Subject: Re: [nflug] need idea
>
> Roelant Ossewaarde wrote:
>
>> Cyber Source wrote:
>>
>>> Roelant Ossewaarde wrote:
>>>
>>>
>>>> I had the same problem. I now have one machine that has scp enabled.
>>>> I have my client scp to that machine, but with a wrong
>>>> username/password (in my case: hifrombuffalo). Since the username
>>>> doesn't exist, the IP shows up in my ftp and auth-log, together with
>>>> the username that tried to log on.
>>>>
>>>> I do that every two hours (which is my rotation time for
>>>> auth/ftp-logs), so if I ever need to check the IP-number, I just
>>>> grep hifrombuffalo in auth.log. Voila!
>>>>
>>>>
>>>>
>>>> Nate Byrnes wrote:
>>>>
>>>>
>>>>> How about matching the message id in your mail logs to see what the
>>>>> hostname or IP of the sender was. If using sendmail grep
>>>>> /var/log/maillog (or your configured location) for the message id
>>>>> from the email header. The last entry in the brackets should be the
>>>>> system which passed the email to your mailserver. Hope this helps.
>>>>>
>>>>> Cyber Source wrote:
>>>>>
>>>>>
>>>>>> Darin Perusich wrote:
>>>>>>
>>>>>>
>>>>>>> why not just have the cron job that runs email you the info from
>>>>>>> ifconfig? assuming that your clients are using unix routes then
>>>>>>> "ifconfig -a |mail peter at thecybersource.com" should send you that
>>>>>>> info your looking for.
>>>>>>>
>>>>>>> Cyber Source wrote:
>>>>>>>
>>>>>>>
>>>>>>>> Hello All,
>>>>>>>> I need an idea where I can find the originating IP of an email.
>>>>>>>> I monitor alot of my clients servers, etc. and I have the cron
>>>>>>>> jobs and such email me, which I have filters for and then sort
>>>>>>>> them by who they are so things are organized. I also like to be
>>>>>>>> able to help my clients out from time to time and ssh in to do
>>>>>>>> things and I would like to not have to tell them to do a
>>>>>>>> /sbin/ifconfig or if they are behind a router, to go to my web
>>>>>>>> site and then I have a look at /var/log/httpd/access.
>>>>>>>> For most of my clients, if I look at the message headers of the
>>>>>>>> cron emails, I can see the IP and then use that to log in,
>>>>>>>> mostly cable dhcp clients. However, I am finding more and more
>>>>>>>> dsl dhcp clients to be a problem because not only do they change
>>>>>>>> alot (and normally not a problem because each day has a new
>>>>>>>> email) but when I look at the dsl clients message headers I see
>>>>>>>> something like this
>>>>>>>>
>>>>>>>> Return-Path: <root at thecybersource.com>
>>>>>>>> Received: from localhost.localdomain
>>>>>>>> (pool-71-251-164-250.bflony.east.verizon.net [71.251.164.250])
>>>>>>>> by thecybersource.com (8.13.1/8.13.1) with ESMTP id k1K9AHeL024738
>>>>>>>>
>>>>>>>> If this were cable, the ip would be 71.251.164.250 but this does
>>>>>>>> not seem to work with dsl, it is not reporting the actual ip
>>>>>>>> that the client used when the box sent the email.
>>>>>>>>
>>>>>>>> So, I am looking for a way to have a cron run or something on
>>>>>>>> the box that can send me a daily email showing the public ip
>>>>>>>> they are using. I initially thought of doing a cron that could
>>>>>>>> do a traceroute but I that doesnt work either. I don't know if
>>>>>>>> something has changed on routers today to block such a process
>>>>>>>> but when I use traceroute today, alot of it just times out with
>>>>>>>> multiple ***.
>>>>>>>> Anyway, ideas anyone?
>>>>>>>> _______________________________________________
>>>>>>>> nflug mailing list
>>>>>>>> nflug at nflug.org
>>>>>>>> http://www.nflug.org/mailman/listinfo/nflug
>>>>>>>>
>>>>>>>
>>>>>>>
>>>>>> That doesnt help when they are behind routers, it only shows the
>>>>>> internal stuff, I need to know the public IP.
>>>>>> _______________________________________________
>>>>>> nflug mailing list
>>>>>> nflug at nflug.org
>>>>>> http://www.nflug.org/mailman/listinfo/nflug
>>>>>>
>>>>>> !DSPAM:43f9d66b47272099511928!
>>>>>>
>>>>>>
>>>>> _______________________________________________
>>>>> nflug mailing list
>>>>> nflug at nflug.org
>>>>> http://www.nflug.org/mailman/listinfo/nflug
>>>>>
>>>>>
>>>> _______________________________________________
>>>> nflug mailing list
>>>> nflug at nflug.org
>>>> http://www.nflug.org/mailman/listinfo/nflug
>>>>
>>>>
>>> Perfect, that's it. But you could also set it up so the person
>>> actually has a key on the host so when they do ssh in or scp it still
>>> shows in the Logwatch file, as it shows all failed/passed ssh
>>> attempts and that gets emailed to me everyday already, Thanks!
>>>
>> Yes, but I don't want to give access to my machine. An access attempt
>> is good enough for me. And now I can use names *I* find easy to use
>> (such as 'hifrombuffalo').
>>
>> _______________________________________________
>> nflug mailing list
>> nflug at nflug.org
>> http://www.nflug.org/mailman/listinfo/nflug
>>
>>
> For us, we will be implementing a daemon that will monitor failed
> attempts and add the ip to the hosts.deny file, so we don't want to
> block them out too. Thanks for the idea.
> _______________________________________________
> nflug mailing list
> nflug at nflug.org
> http://www.nflug.org/mailman/listinfo/nflug
>
> _______________________________________________
> nflug mailing list
> nflug at nflug.org
> http://www.nflug.org/mailman/listinfo/nflug
>
>
That's a good idea too but I prefer the ssh way, I look at the logs
daily anyway, no parsing. I do the web server thing(as mentioned
initially) but that can be a pain too with as busy a web server as we have.
_______________________________________________
nflug mailing list
nflug at nflug.org
http://www.nflug.org/mailman/listinfo/nflug
More information about the nflug
mailing list