We're running a spam trap / honeypot, and by using the amazing guidance of the members here, I've been able to configure our Ubuntu server running Postfix 2.11.0 to catch all inbound email, regardless of destination address, and send the email to a python script which in turn writes the email to a file. The python script looks like:
#!/usr/bin/env python
import sys
import email
import os
import datetime
em = email.message_from_file(sys.stdin) # Read message from Std Input
strFilename = datetime.datetime.now().strftime('%Y%m%d%H%M%S') + ".eml"
output = open('/var/mail/' + strFilename, 'w')
output.write(str(em))
output.close()
My question is: when we receive an email with two or more recipients, the python script is writing two (or more) .eml files instead of 1 file with both recipients listed. I've compared the .eml files, and they're identical with the exception of 1 line in the header of each file. For example, if I personally send an email to our honeypot collector with a TO address of soccer12@example.com, and a CC to soccer34@example.com, the only difference in each file is one line that looks like:
X-Original-To: soccer12@example.com
and the other
X-Original-To: soccer34@example.com
Is there anyway to write only one file with both X-Original-To: fields listed?
Edit:
Additional info: SMTP-sink does what we need, and is the path that we're currently running with, but we're hoping to use postfix instead. In postfix main.cf, I've added:
virtual_alias_maps = pcre:/etc/postfix/virtual
And then I've created a file at /etc/postfix/virtual that contains
/.*/ mailin
In /etc/aliases, I've added:
#/etc/aliases
mailin: "|/var/mail/mailcatch.py"
And then my mailcatch.py contains the python script above. I also created a new user called "mailin".
Best Answer
I'm afraid that the answer of your question
is
NO
Postfix use
X-Original-To
header to perform recipient duplication. Of course, you can make postfix write only one file by configure this parameter via main.cfThe side effect is you will lose original recipient record in both message and maillog.
reference