A quick hacky monitoring thing to see if there's a newish IP from which people are logging into IMAP (dovecot). It displays ISP/netblock info. Keeps a naive his

A quick hacky monitoring thing to see if there's a newish IP from which people are logging into IMAP (dovecot). It displays ISP/netblock info. Keeps a naive history and displays *NEW* if the IP is new. #!/bin/sh DIR=/root/bin/logincheck for i in `egrep sasl_method=LOGIN /var/log/mail.log |cut -d '[' -f 3 |cut -d ']' -f 1 |sort |uniq`; do echo; echo if grep -qw "${i}" ${DIR}/history.txt; then echo " === ${i} === "; else echo " === ${i} (**NEW**) === "; echo ${i} >> ${DIR}/history.txt fi whois $i |grep -i 'organ\|descr\|netname'; done;