Educause Security Discussion mailing list archives

Re: Tracking use of your central credentials


From: Mike Iglesias <iglesias () UCI EDU>
Date: Thu, 20 Nov 2008 15:55:13 -0800

Bob Bayn wrote:
We'd like to be able to tell which credentials are being used to login from China so we can check with those users to 
see if they ARE in China.

If you can parse your logs with perl, you can use the Geo::IP::PurePerl module
(available from CPAN) to get the two character country code for the IP used,
and then generate your reports based on that.  For example, we use that module
to generate reports for users of our VPN service so they can tell if their
ID/password is being misused from outside the US.  You do have to keep a
database up to date but it's only updated once a month at the source so it's
not that hard.  Just download the new file and replace the old one with it.


--
Mike Iglesias                          Email:       iglesias () uci edu
University of California, Irvine       phone:       949-824-6926
Network & Academic Computing Services  FAX:         949-824-2270

Current thread: