Edit: /opt/dedrads/__pycache__/mail_sources.cpython-313.pyc (9969B)
}j S r SSKrSSKrSSKrSSKrSSKrSSKrSSKJr SSK J
r
Sr Sr SS jr
SS jrSS jrS
rS rS r\S
:X a \" 5 gg)z4List sources of email sent by address and directory. N) defaultdict)ArgumentParserzDaniel Kzdanielk@inmotionhosting.comc # # / nU ( a [ R " S5 nU Hv n[ R R U5 ( d$ [ SU 35 [
R " S5 [ R " US5 n U Sh vN SSS5 Mx Sn[ R R U5 ( d$ [ SU 35 [
R " S5 [ US S
9 n U Sh vN SSS5 g Ny! [ a1 n[ SU SU 35 [
R " S5 SnANSnAff = f! , ( d f GM3 = f N`! [ a' [ S U 35 [
R " S5 N[ a0 n[ S U S
35 [ U 5 [ S5 SnANSnAff = f! , ( d f g= f7f)z$Return iterable over email log linesz/var/log/exim_mainlog?*zCould not find log file: rNError reading file '': z/var/log/exim_mainlogutf-8encodingzError reading file z Received decoding error for :z
continuing...) globospathexistsprintsysexitgzipopenOSErrorUnicodeDecodeError)all_logslog_listlog_filemail_logerrores /opt/dedrads/mail_sources.py email_linesr sz H99 67 H77>>(++1(<= 8S)X ''' *)
! 'H
77>>( # #
)(45
h )X #
* ) ( 0
#eWEFHHQKK *)
'z2 3 HHQK! # 0
!< = QCM / " " #
* )s BGED
DD A G2G4E 9E:E > GD
E'D?:E?EE
E GE .G
G G&G ;G GG
GGc ^ U S:X a g/ nSU 3n[ R R U5 ( d0 [ SR X5 5 [
R " S5 [ R " S5 n[ USS9 n U H< nUR U5 nUc M UR UR S5 S
5 M> S S S 5 S
R U5 $ ! [ a1 n[ S U S U 35 [
R " S5 S nANOS nAff = f! , ( d f N]= f)z Get domain regex for username z[^@ ]+z/var/cpanel/users/zBCould not find domains for {}. Invalid cPanel user? Cannot find {}r z^DNS[0-9]*=(.*)$r
r Nr r r |)r r r r formatr r recompiler searchappendgroupsr join)username domain_list user_filedns_rxr line dns_matchr s r get_domainsr1 8 s 2~K$XJ/I
77>>) $ $
228&2M
ZZ+
,F
i' *h "MM$ / ( &&y'7'7':1'=> !
+ 88K ( 3ug> ? HHQKK
+ *s6 D C 'C
D*'DD DD
D,c [ [ 5 n[ [ 5 n[ [ 5 n[ U5 nUS:X a SnSnO[S[ U5 ; a UnSnOG[ U[ 5 ( d S5 eSn[ U5 n[
R
R
5 n [ R " S5 n
[ R " SR U5 5 n [ R " SR U5 5 n [ R " SU S 35 n
[ U 5 GH nUS:w a UR U5 ( d M" U
R U5 ( d M: US: a: UW [
R
R US
S S 5 -
R 5 : d Mz U R UR! 5 5 nU( aa S
R UR# S5 UR# S5 5 nUU [% UR# S5 R' 5 5 - UU' U R UR! 5 5 nU( aE UR# S5 nUU [% UR# S5 R' 5 5 - UU' GMl U
R U5 nU( d GM UR# S5 nSU; a GM UU S- UU' GM X4U4$ )z(Returns touple of dicts of email sourcesr" r -zTime is not date or numberz#\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}zV(courier|dovecot)_(plain|login):(?P
[^@ ]+(@(?P{}))?) .*for (?P.*)$z<= (?P[^@]*@[^@ ]+).*(courier|dovecot)_(plain|login):(?P(?!(?P=sender))[^@ ]+(@(?P{}))?).*for (?P.*)$zcwd=(?P/home/z[^ ]*)N z%Y-%m-%d %H:%M:%Sz{} as {}loginsenderfor directoryz/usr/local/cpanel/r )r intr1 str
isinstancedatetimenowr% r& r$ r
startswithmatchstrptime
total_secondsr' lowergrouplensplit)r r+ time email_loginsworking_directoriesspoofingdomainsdatedurationtarget datetime_rxlogin_rx spoofing_rx directory_rxr/ rx_match logged_inaddressr8 s r get_sourcesrU X s s#L%c*3 H(#G rz D $$$B&BB$t9""&&(** CDKzz $fWoH ** %fWo K ::!9(6 JKLH% 2:dood 3 3 && a< ##,,T#2Y8KLMmo
%%djjl3 "))w' )AI #+9"5u%++-9 #HY ??4::<0 nnW-G$0$9Cu%++-= %L !
&&t, 8 {3I#y0-@-Ka-O * Q &T
x 88 c ^ [ X R S9 H n[ X S SU 35 M g)z#Print a dictionary sorted by values)keyz>7 N)sortedgetr )
dictionaryvalues r print_sorted_dictr^ s0
7
"2&b01 8rV c [ [ S9n U R SSSSS9 U R SS[ S S
S 9 U R 5 nUR S S
S[ SSS9 UR SSS[
SSS9 UR SSSSS9 U R
5 nUR nUR c SnO UR n[ R " S5 nUR ( a SnSnOUR S:w a[ UR UR 5 ( d. [ S UR 35 [ R " S 5 UR nO!UR" S: a UR" nSnOSnX4U4$ ) zParse command line aruments) descriptionz-az--all
store_truez7Search all email logs, rather than only the recent log.)actionhelpr+ USER?z4Search for only email from a specific cPanel account)metavartypenargsrc z-dz--datestorer" zLSearch for entries from a certain date. Must be in the format of YYYY-MM-DD.)rb rg defaultrc z-sz --secondsr zWSearch entries which were made within the specified number of seconds. Overrides --all.z-rz--recentz\Search recent entries, from the last hour. This is the same as -s 3600. Also overrides --allz\d{4}-\d{2}-\d{2}i Fz#Date is not in the correct format: r )r __doc__ add_argumentr: add_mutually_exclusive_groupr9
parse_argsallr+ r% r& recentrK r? r r r seconds)parser
time_groupargsr r+ date_rxrF s r rn rn s
0F
F
C 446J
3
2
@ DxxH }} ==jj-.G {{
b }}TYY'' 7 {C D HHQKyy
|| t ##rV c [ 5 u pn[ XU5 u p4n[ S5 [ U5 [ S5 [ U5 [ S5 [ U5 S:X d [ U5 g[ S5 g)zMain function for scriptz
Email Logins:z
Source directories:z
Possibly spoofed emails:r z No obvious spoofs foundN)rn rU r r^ rD )r r+ rF rG rH rI s r mainrw sn ", X4?D51\
/l#
!")*
&' x=A (#
)*rV __main__)F)r" )Fr" r" )rk r r r% r r r< collectionsr argparser
__author__ __email__r r1 rU r^ rn rw __name__ rV r r sb :
# #
) $#N !@L9^2Q$h+, zF rV