[PATCH 5/5] Perform reverse DNS lookups on Dovecot remote IP addresses

---
 scripts/services/dovecot |   31 +++++++++++++++++++++++++++++++
 1 files changed, 31 insertions(+), 0 deletions(-)

diff --git a/scripts/services/dovecot b/scripts/services/dovecot
index afe7134..9480779 100755
--- a/scripts/services/dovecot
+++ b/scripts/services/dovecot
@@ -100,6 +100,31 @@ if ( $Debug >= 5 ) {
     print STDERR "\n\nDEBUG \n\n";
 }
 
+use Socket;
+my $rdns = {};
+sub hostName {
+   (my $ipaddr) = @_;
+
+   if (exists $rdns{ $ipaddr }) {
+      return $rdns{ $ipaddr };
+   }
+   $rdns{ $ipaddr } = $ipaddr;
+
+   my $iaddr = inet_aton($ipaddr);
+   if (defined $iaddr) {
+      my $host = gethostbyaddr($iaddr, AF_INET);
+      if (defined $host) {
+         my $iaddrcheck = gethostbyname($host);
+         if (defined $iaddrcheck) {
+            if ($iaddr == $iaddrcheck) {
+               $rdns{ $ipaddr } = $host;
+            }
+         }
+      }
+   }
+   return $rdns{ $ipaddr };
+}
+
 # Handle "dovecot: <svc>" and "dovecot: [ID yyyyy mail.info] <svc"
 my $dovecottag = qr/dovecot:(?:\s*\[[^]]+\])?/;
 
@@ -126,6 +151,7 @@ while (defined($ThisLine = <STDIN>)) {
          $End = 0;
      } elsif ( ($User, $Host) = ( $ThisLine =~ /^pop3-login: Login: (.*?) \[(.*)\]/ ) ) {
       if ($Host !~ /$IgnoreHost/) {
+         $Host = hostName($Host);
          $Login{$User}{$Host}++;
          $LoginPOP3{$User}++;
          $ConnectionPOP3{$Host}++;
@@ -133,6 +159,7 @@ while (defined($ThisLine = <STDIN>)) {
       }
    } elsif ( ($User, $Host) = ( $ThisLine =~ /^imap-login: Login: (.*?) \[(.*)\]/ ) ) {
       if ($Host !~ /$IgnoreHost/) {
+         $Host = hostName($Host);
          $Login{$User}{$Host}++;
          $LoginIMAP{$User}++;
          $ConnectionIMAP{$Host}++;
@@ -140,6 +167,7 @@ while (defined($ThisLine = <STDIN>)) {
       }
    } elsif ( ($User, $Host) = ( $ThisLine =~ /managesieve-login: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/ ) ) {
       if ($Host !~ /$IgnoreHost/) {
+         $Host = hostName($Host);
          $SieveLogin{$User}{$Host}++;
          $LoginSieve{$User}++;
          $ConnectionSieve{$Host}++;
@@ -182,6 +210,7 @@ while (defined($ThisLine = <STDIN>)) {
 # This is for Dovecot 1.0 series
     } elsif ( ($User, $Host) = ( $ThisLine =~ /^$dovecottag pop3-login: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/ ) ) {
       if ($Host !~ /$IgnoreHost/) {
+         $Host = hostName($Host);
          $Login{$User}{$Host}++;
          $LoginPOP3{$User}++;
          $ConnectionPOP3{$Host}++;
@@ -189,6 +218,7 @@ while (defined($ThisLine = <STDIN>)) {
       }
    } elsif ( ($User, $Host) = ( $ThisLine =~ /^$dovecottag imap-login: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/) ) {
       if ($Host !~ /$IgnoreHost/) {
+         $Host = hostName($Host);
          $Login{$User}{$Host}++;
          $LoginIMAP{$User}++;
          $ConnectionIMAP{$Host}++;
@@ -206,6 +236,7 @@ while (defined($ThisLine = <STDIN>)) {
    } elsif (($Reason, $Host) = ($ThisLine =~ /TLS initialization failed/) ) {
       $TLSInitFail++;
    } elsif (($Host) = ($ThisLine =~ /Aborted login \[(.*)\]/) ) {
+      $Host = hostName($Host);
       $Aborted{$Host}++;
    } elsif (($Reason) = ($ThisLine =~ /Aborted login \((.*)\):/)) {
       $Aborted{$Reason}++;
-- 
1.7.4.1


------------------------------------------------------------------------------
Better than sec? Nothing is better than sec when it comes to
monitoring Big Data applications. Try Boundary one-second 
resolution app monitoring today. Free.
http://p.sf.net/sfu/Boundary-dev2dev