From d4320aea829a210f5a489ac50db0caecab21d6b1 Mon Sep 17 00:00:00 2001 From: Lars Kruse Date: Fri, 3 Aug 2018 12:59:16 +0200 Subject: [PATCH 1/5] Plugin postfix-rbl-blocked-mails: improve autoconf output --- plugins/postfix/postfix-rbl-blocked-mails | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/plugins/postfix/postfix-rbl-blocked-mails b/plugins/postfix/postfix-rbl-blocked-mails index 73fa2794..e7444e64 100755 --- a/plugins/postfix/postfix-rbl-blocked-mails +++ b/plugins/postfix/postfix-rbl-blocked-mails @@ -9,12 +9,12 @@ DATE=`date '+%b %e %H'` MAXLABEL=20 if [ "$1" = "autoconf" ]; then - if [[ -r $LOGFILE ]]; then - echo yes - else - echo no - fi - exit 0 + if [ -r "$LOGFILE" ]; then + echo yes + else + echo "no (log file not found: $LOGFILE)" + fi + exit 0 fi if [ "$1" = "config" ]; then From f3525cfa4a8e8cfbd0d3dd8d866286bc5fd46ee6 Mon Sep 17 00:00:00 2001 From: Lars Kruse Date: Fri, 3 Aug 2018 13:00:34 +0200 Subject: [PATCH 2/5] Plugin postfix-rbl-blocked-mails: unify whitespace --- plugins/postfix/postfix-rbl-blocked-mails | 24 +++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/plugins/postfix/postfix-rbl-blocked-mails b/plugins/postfix/postfix-rbl-blocked-mails index e7444e64..07fda13d 100755 --- a/plugins/postfix/postfix-rbl-blocked-mails +++ b/plugins/postfix/postfix-rbl-blocked-mails @@ -4,7 +4,8 @@ # Monitor blocked Mails during Postfix RBL Scan, included Spamhaus, Spamcop, Manitu, MSRBL, NJABL -LOGFILE=${logfile:-/var/log/mail.log} # Allow user to specify logfile through env.logfile +# Allow user to specify logfile through env.logfile +LOGFILE=${logfile:-/var/log/mail.log} DATE=`date '+%b %e %H'` MAXLABEL=20 @@ -18,17 +19,16 @@ if [ "$1" = "autoconf" ]; then fi if [ "$1" = "config" ]; then - - echo 'graph_title RBL Counter' - echo 'graph_category mail' - echo 'graph_args --base 1000 -l 0' - echo 'graph_vlabel block during RBL' - echo 'spamhaus.label Blocked by Spamhaus.org' - echo 'spamcop.label Blocked by Spamcop' - echo 'manitu.label Blocked by manitu.net' - echo 'msrbl.label Blocked by msrbl.net' - echo 'njabl.label Blocked by njabl.org' - exit 0 + echo 'graph_title RBL Counter' + echo 'graph_category mail' + echo 'graph_args --base 1000 -l 0' + echo 'graph_vlabel block during RBL' + echo 'spamhaus.label Blocked by Spamhaus.org' + echo 'spamcop.label Blocked by Spamcop' + echo 'manitu.label Blocked by manitu.net' + echo 'msrbl.label Blocked by msrbl.net' + echo 'njabl.label Blocked by njabl.org' + exit 0 fi From e77b778c911a8c653c4c952d30f830d504bc9009 Mon Sep 17 00:00:00 2001 From: Lars Kruse Date: Fri, 3 Aug 2018 13:05:16 +0200 Subject: [PATCH 3/5] Plugin postfix-rbl-blocked-mails: separate count function --- plugins/postfix/postfix-rbl-blocked-mails | 25 +++++++++++++---------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/plugins/postfix/postfix-rbl-blocked-mails b/plugins/postfix/postfix-rbl-blocked-mails index 07fda13d..d9e595d6 100755 --- a/plugins/postfix/postfix-rbl-blocked-mails +++ b/plugins/postfix/postfix-rbl-blocked-mails @@ -9,6 +9,15 @@ LOGFILE=${logfile:-/var/log/mail.log} DATE=`date '+%b %e %H'` MAXLABEL=20 + +get_blocked_by_domain_count() { + local escaped_domain + # escape dots - for a proper regular expression + escaped_domain=$(echo "$1" | sed 's/\./\\./g') + grep -c "$DATE.*blocked using [^ ]*${escaped_domain}" "$LOGFILE" +} + + if [ "$1" = "autoconf" ]; then if [ -r "$LOGFILE" ]; then echo yes @@ -32,14 +41,8 @@ if [ "$1" = "config" ]; then fi -echo -en "spamhaus.value " -echo $(grep "blocked using sbl-xbl.spamhaus.org" $LOGFILE | grep "$DATE" | wc -l) -echo -en "spamcop.value " -echo $(grep "blocked using bl.spamcop.net" $LOGFILE | grep "$DATE" | wc -l) -echo -en "manitu.value " -echo $(grep "blocked using ix.dnsbl.manitu.net" $LOGFILE | grep "$DATE" | wc -l) -echo -en "msrbl.value " -echo $(grep "blocked using combined.rbl.msrbl.net" $LOGFILE | grep "$DATE" | wc -l) -echo -en "njabl.value " -echo $(grep "blocked using combined.njabl.org" $LOGFILE | grep "$DATE" | wc -l) - +printf 'spamhaus.value %s\n' "$(get_blocked_by_domain_count "sbl-xbl.spamhaus.org")" +printf 'spamcop.value %s\n' "$(get_blocked_by_domain_count "bl.spamcop.net")" +printf 'manitu.value %s\n' "$(get_blocked_by_domain_count "ix.dnsbl.manitu.net")" +printf 'msrbl.value %s\n' "$(get_blocked_by_domain_count "combined.rbl.msrbl.net")" +printf 'njabl.value %s\n' "$(get_blocked_by_domain_count "combined.njabl.org")" From 9e47c112b97ca6129f5510084d71e980ad7f642e Mon Sep 17 00:00:00 2001 From: Lars Kruse Date: Fri, 3 Aug 2018 13:05:40 +0200 Subject: [PATCH 4/5] Plugin postfix-rbl-blocked-mails: count by top-level-domain It looks like the spamhaus domain changed from sbl-xbl.spamhaus.org to zen.spamhaus.org. The same may have happened for other RBL domains. Thus we just filter by the top level domain (instead of the specific sub-domain). --- plugins/postfix/postfix-rbl-blocked-mails | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/plugins/postfix/postfix-rbl-blocked-mails b/plugins/postfix/postfix-rbl-blocked-mails index d9e595d6..beb78b4e 100755 --- a/plugins/postfix/postfix-rbl-blocked-mails +++ b/plugins/postfix/postfix-rbl-blocked-mails @@ -41,8 +41,13 @@ if [ "$1" = "config" ]; then fi -printf 'spamhaus.value %s\n' "$(get_blocked_by_domain_count "sbl-xbl.spamhaus.org")" -printf 'spamcop.value %s\n' "$(get_blocked_by_domain_count "bl.spamcop.net")" -printf 'manitu.value %s\n' "$(get_blocked_by_domain_count "ix.dnsbl.manitu.net")" -printf 'msrbl.value %s\n' "$(get_blocked_by_domain_count "combined.rbl.msrbl.net")" -printf 'njabl.value %s\n' "$(get_blocked_by_domain_count "combined.njabl.org")" +# sbl-xbl.spamhaus.org or zen.spamhaus.org +printf 'spamhaus.value %s\n' "$(get_blocked_by_domain_count "spamhaus.org")" +# bl.spamcop.net +printf 'spamcop.value %s\n' "$(get_blocked_by_domain_count "spamcop.net")" +# ix.dnsbl.manitu.net +printf 'manitu.value %s\n' "$(get_blocked_by_domain_count "manitu.net")" +# combined.rbl.msrbl.net +printf 'msrbl.value %s\n' "$(get_blocked_by_domain_count "msrbl.net")" +# combined.njabl.org +printf 'njabl.value %s\n' "$(get_blocked_by_domain_count "njabl.org")" From b115cb2b7c73403d69d88c6214e2cea2192079bc Mon Sep 17 00:00:00 2001 From: Lars Kruse Date: Fri, 3 Aug 2018 13:08:18 +0200 Subject: [PATCH 5/5] Plugin postfix-rbl-blocked-mails: shellcheck cleanup; switch to /bin/sh --- plugins/postfix/postfix-rbl-blocked-mails | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/plugins/postfix/postfix-rbl-blocked-mails b/plugins/postfix/postfix-rbl-blocked-mails index beb78b4e..cfb525b6 100755 --- a/plugins/postfix/postfix-rbl-blocked-mails +++ b/plugins/postfix/postfix-rbl-blocked-mails @@ -1,4 +1,4 @@ -#!/bin/bash +#!/bin/sh # # Made by Stefan Bühler, Switzerland # Monitor blocked Mails during Postfix RBL Scan, included Spamhaus, Spamcop, Manitu, MSRBL, NJABL @@ -6,8 +6,7 @@ # Allow user to specify logfile through env.logfile LOGFILE=${logfile:-/var/log/mail.log} -DATE=`date '+%b %e %H'` -MAXLABEL=20 +DATE=$(date '+%b %e %H') get_blocked_by_domain_count() {