-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > not sure how he's accessing (dial-in, dsl, etc) but your could certainly > catch him by doing a tcpdump filtering on pop3 (and hopefully) his ip > address. you'll see the DELE command in the data section of the tcp > packets ... > > of course, some sort of transaction logging would be better :-), but if > all else fails ...
Great googly moogly. How about setting up telemetry? Granted you're going to end up with all his mail in there too, but it'd be easier than sniffing the traffic. - From overview.html: log Directory The subdirectory "log" under the configuration directory permits administrators to keep protocol telemetry logs on a per-user basis. If a subdirectory of "log" exists with the same name as a user, the IMAP and POP3 servers will keep a telemetry log of protocol sessions authenticating as that user. The telemetry log is stored in the subdirectory with a filename of the server process-id and starts with the first command following authentication. - -- Chris Hilts [EMAIL PROTECTED] Say it with flowers -- Send them a triffid! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (MingW32) iD8DBQFDOYP998ixrK2vMtARAjrRAJ9VjvyzfgYdBws5+6CdvqRK2ziUVACgkWIN DGtc6PhiLMFq7qXxk7+oQi8= =44BB -----END PGP SIGNATURE----- ---- Cyrus Home Page: http://asg.web.cmu.edu/cyrus Cyrus Wiki/FAQ: http://cyruswiki.andrew.cmu.edu List Archives/Info: http://asg.web.cmu.edu/cyrus/mailing-list.html
