Wednesday, June 25, 2014

Bash Script de notificación RBL (Realtime Blacklist) SPAM postfix

Este bash script notifica por email cuando detecta que el servidor de correo saliente "postfix" es considerado SPAMER.


Script bash
#!/bin/bash
## Autor: Pedro Flor
## E-Mail: pedro.flor@gmail.com
## Fecha: 25.06.2014
## Version: 1.1
## Definicion de IP y PORT SMTP server
SMTP_SERVER="172.21.0.101"
SMTP_PORT_SERVER="25"
## Definicion de palabras clave a buscar
export WORDS="rejected|SenderBase|reputation|spamhaus|banned|JunkMail|550|poor|exceeded|limit|refused"
## Funcion que verifica si POSTFIX es considerado SPAMER
function check_spam () {
COUNTER_SPAM=$(postqueue -p | egrep -i "$WORDS" | wc -l)
if [ "$COUNTER_SPAM" -ne "0" ]
then
spammail_alert | telnet $SMTP_SERVER $SMTP_PORT_SERVER
echo "$(date) :::: Counter: $COUNTER_SPAM" >> /tmp/rbl_reporter.log
exit
fi
echo "$(date) :::: Counter: $COUNTER_SPAM" >> /tmp/rbl_reporter.log
}
## Funcion que envia un mensaje de correo con la notificacion del problema
function spammail_alert () {
echo "helo mail.com"
echo "mail from:"
echo "rcpt to:"
echo "data"
sleep 0.2s
echo "To: "
sleep 0.2s
echo "Return-path: "
sleep 0.2s
echo "Subject: ADVERTENCIA RBL SMTPRELAY!!!"
sleep 0.2s
echo ""
sleep 0.2s
echo "+======================================================+"
echo ""
sleep 0.2s
echo " Advertencia. Posible listado en BLACK LISTS."
sleep 0.2s
echo " Entradas sospechosas en la ultima hora: $COUNTER_SPAM "
echo ""
sleep 0.2s
echo "+======================================================+"
sleep 0.2s
echo "."
sleep 0.2s
echo "QUIT"
}
##
## Llama a la funcion de validacion
##
check_spam

Crontab
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/
*/15 * * * * /usr/local/bin/rbl-reporter.sh &