Scanning for POP3 users

robotman

I've been given the task of finding all the users who are (despite repeated warnings) still retrieving their mail via POP3.

It's a small corporate site and we use Lotus Notes, and we are trying to eliminate all POP3 usage.

I've been given the job of finding all the users still using outlook and outlook express so they can be told to stop it.

Anyone know of a networks scanner i can use that would do this?
cheers

zAbbo

turn off pop3 and wait for your phone to ring ?

How many accounts are you talking about in the company ?

robotman

turn off pop3 and wait for your phone to ring

Hahaha, that was exactly what i said.

Unfortunately there are some users who are just so important that i'm not allowed to do that, and anyway, we have to warn them first.

Edit: there are about 1200 user accounts on the network but i'd guess there are only about 20 or 30 people accessing their mail via POP3

monkey tennis

robotman wrote: »

Anyone know of a networks scanner i can use that would do this?
cheers

You can't 'scan' for a POP3 client, but you could sniff traffic going through a central point (e.g. central switch or router) to try to spot POP3 connections.

An easier way might be to go through the server logs, if they are any use.

wandererz

Perhaps you could try this:

Go to http://<Server IP>.names.nsf/$Users

Login when prompted and you should see your entire user database including <GULP> unsalted password hashes.

But anyway, thats a different nightmare altogether. Scroll across and you should have a column for POP which should indicate which users are enabled for POP3.

It won't show you who has logged in but will give you a basic audit of who is enabled for POP3 and you could then disable those users who shouldn't have those priveleges.

azzeretti

I don't think this would be that hard. What sort of firewall is their first hop to. I would be surprised (considering its a bit site) that you couldn't run a report on the logs to filter on POP3 destination port and its source IP address. Failing that, you could, as suggested earlier, stick a sniffer on and filter that for POP3.

Alternatively, you could, depending on your setup, create a redirection rule for all outgoing POP3 connections, you could then log these connections. Of Course you would need some sort of upstream device to re-redirection the traffic back to 110 on the outside, so this mightn't be a runner.