NAME

            

              
              
SyslogScan::Daemon::SpamDetector::SpamSink - notice messages sent to a honeypot
            
          

SYNOPSIS

            

              
              
plugin SyslogScan::Daemon::SpamDetector as sd_
sd_plugin SyslogScan::Daemon::SpamDetector::SpamSink
debug 0
logfile /var/log/mail.info
            
          

DESCRIPTION

Watch the system log files for message sent to spam honeypots.

It looks for the following kind of message line:

            

              
              
$Date \S+ spamsink: Message-I[dD]: <.*?>
            
          

Lines like this can be generate by forwarding mail to a program like:

            

              
              
#!/bin/sh 
perl -e '
       $x = <>; 
       while (<>) { 
               last if /^$/; 
               next unless /^(Message-I[dD]: .*)/; 
               $y = $1; 
       } 
       print "$y\n" 
               if      $x =~ /\@/ 
                       && $y =~ /\@/ 
                       && $x !~ /mailer-daemon/i 
                       && $x !~ /postmaster/ ; 
' | /usr/bin/logger -p mail.info -t spamsink
            
          

CONFIGURATION PARAMETERS

The following configuration parameters are supported:

debug

Debugging on (1) or off (0).

logfile

Which logfile to watch (default: /var/log/syslog).

SEE ALSO

SyslogScan::Daemon::SpamDetector

THANK THE AUTHOR

If you need high-speed internet services (T1, T3, OC3 etc), please send me your request-for-quote. I have access to very good pricing: you'll save money and get a great service.

LICENSE

Copyright(C) 2006 David Muir Sharnoff <muir@idiom.com>. This module may be used and distributed on the same terms as Perl itself.