141 lines
3.3 KiB
Markdown
141 lines
3.3 KiB
Markdown
# 📬 Postfix Mail Summary Script
|
|
|
|
A hardened, production-ready Bash script for analyzing Postfix mail logs with a **clean, readable output format**.
|
|
|
|
Designed with **security, performance, and portability** in mind.
|
|
|
|
---
|
|
|
|
## 🚀 Features
|
|
|
|
- 📊 **Clean, formatted output** (with optional colors)
|
|
- 🔍 **Filter by**:
|
|
- Sender (`--from`)
|
|
- Recipient (`--to`)
|
|
- Queue ID (`--id`)
|
|
- Date (`--date`)
|
|
- ⚡ **Optimized log reading** (avoids full log parsing when possible)
|
|
- 🛡️ **Hardened against**:
|
|
- Command injection
|
|
- Regex/ReDoS attacks
|
|
- Memory leaks
|
|
- Log-based DoS
|
|
- 🧠 **Smart parsing** of Postfix logs (including `NOQUEUE` rejects)
|
|
- 🎯 **Portable** across Linux distributions
|
|
|
|
---
|
|
|
|
## 📦 Requirements
|
|
|
|
- Bash (>= 4.x recommended)
|
|
- Standard Linux utilities:
|
|
- `awk`
|
|
- `grep`
|
|
- `sed`
|
|
- `tail`
|
|
- `find`
|
|
- `zcat`
|
|
|
|
---
|
|
|
|
## ⚙️ Installation
|
|
|
|
```bash
|
|
git clone https://git.robott.sk/robott/mail-status.git
|
|
cd mail-status
|
|
chmod +x mail-status.sh
|
|
▶️ Usage
|
|
sudo ./mail-status.sh [OPTIONS]
|
|
📖 Options
|
|
Option Description
|
|
-h, --help Show help message
|
|
-l, --list NUMBER Show last X records (default: 10, max: 1000)
|
|
-f, --from Filter by sender (substring match)
|
|
-t, --to Filter by recipient (substring match)
|
|
-i, --id Filter by Queue ID
|
|
-d, --date "MMM DD" Filter by date (e.g. "Mar 27")
|
|
|
|
Search across all logs for a specific user:
|
|
|
|
sudo ./mail-status.sh -f user@example.com -d ""
|
|
|
|
Or search for a specific date:
|
|
|
|
sudo ./mail-status.sh -f user@example.com -d "Mar 23"
|
|
📌 Examples
|
|
|
|
Show last 10 records
|
|
|
|
sudo ./mail-status.sh
|
|
|
|
Show last 50 records
|
|
|
|
sudo ./mail-status.sh -l 50
|
|
|
|
Filter by sender
|
|
|
|
sudo ./mail-status.sh -f gmail.com
|
|
|
|
Filter by recipient
|
|
|
|
sudo ./mail-status.sh -t example.com
|
|
|
|
Filter by Queue ID
|
|
|
|
sudo ./mail-status.sh -i 3F2A12345
|
|
|
|
Filter by date
|
|
|
|
sudo ./mail-status.sh -d "Mar 27"
|
|
🖥️ Output Example
|
|
DATE-TIME ID CLIENT_IP SENDER RECIPIENT STATUS REASON
|
|
Mar-27-12:00:01 3F2A12345 192.168.1.10 user@gmail.com admin@example.com sent [OK]
|
|
Mar-27-12:01:05 NOQUEUE 45.12.34.56 spam@bad.com user@example.com REJECT [Policy]
|
|
🔐 Security Design
|
|
|
|
This script is designed with security-first principles:
|
|
|
|
✅ Protected Against:
|
|
|
|
Command injection
|
|
AWK injection
|
|
Regex-based DoS (ReDoS)
|
|
Malicious filenames
|
|
Memory exhaustion
|
|
Log flooding
|
|
|
|
🔒 Key Techniques:
|
|
|
|
Input length limiting
|
|
Substring matching (index() instead of regex)
|
|
Safe file handling (find -print0, arrays)
|
|
Temporary file isolation (mktemp)
|
|
Automatic cleanup (trap)
|
|
No use of eval
|
|
⚡ Performance Optimizations
|
|
Reads only last 50,000 lines by default
|
|
Full log scan only when necessary (--date, --id)
|
|
Avoids unnecessary process spawning
|
|
Efficient AWK parsing with memory cleanup
|
|
🎨 Color Output
|
|
Automatically enabled when running in a terminal
|
|
Disabled when piping output (e.g., | less, | grep)
|
|
⚠️ Notes
|
|
Must be run as root (required for log access)
|
|
Works with standard Postfix logs:
|
|
/var/log/maillog
|
|
Rotated logs (maillog.*, .gz)
|
|
🛠️ Future Improvements (Optional)
|
|
Real-time monitoring (tail -f)
|
|
JSON export for SIEM tools (ELK, Splunk)
|
|
Fail2ban integration (auto-block IPs)
|
|
Spam pattern detection
|
|
📄 License
|
|
|
|
MIT License
|
|
|
|
👨💻 Author
|
|
|
|
robott GitHub: https://github.com/robott
|
|
|
|
Powered by Gitea |