%PDF- %PDF-
Direktori : /scripts2/attic/ |
Current File : //scripts2/attic/detect_steel_pop3_account.sh |
# /bin/bash DATE_S="`date +"%m-%d %H:"`" LOG_EXIM=`cat /var/log/exim_mainlog | grep "$DATE_S" | grep courier_login | egrep -v "AES256-SHA|authenticator failed" | cut --delimiter=" " --fields=9,10 | cut --delimiter=":" --fields=2 | cut --delimiter=" " --fields=1 | sort | uniq -c | sort -n | tail -n 10` FS_BAK=$IFS IFS=$'\n' POP3_HACK="" for ACCOUNT in $LOG_EXIM do #echo $ACCOUNT NUM=`echo "$ACCOUNT" | awk '{ print $1 }'` POP3=`echo "$ACCOUNT" | awk '{ print $2 }'` if [ $NUM -gt 500 ]; then POP3_HACK="${POP3_HACK}$POP3" fi done if [ "$POP3_HACK" != "" ]; then echo "$POP3_HACK" | mail -s "POP3 haciendo SPAM en `hostname`" noc@sitioshispanos.com fi