We're running a spam trap / honeypot, and by using the amazing guidance of the members here, I've been able to configure our Ubuntu server running Postfix 2.11.0 to catch all inbound email, regardless of destination address, and send the email to a python script which in turn writes the email to a file. The python script looks like:
#!/usr/bin/env python import sys import email import os import datetime em = email.message_from_file(sys.stdin) # Read message from Std Input strFilename = datetime.datetime.now().strftime('%Y%m%d%H%M%S') + ".eml" output = open('/var/mail/' + strFilename, 'w') output.write(str(em)) output.close()
My question is: when we receive an email with two or more recipients, the python script is writing two (or more) .eml files instead of 1 file with both recipients listed. I've compared the .eml files, and they're identical with the exception of 1 line in the header of each file. For example, if I personally send an email to our honeypot collector with a TO address of email@example.com, and a CC to firstname.lastname@example.org, the only difference in each file is one line that looks like:
and the other
Is there anyway to write only one file with both X-Original-To: fields listed?
Additional info: SMTP-sink does what we need, and is the path that we're currently running with, but we're hoping to use postfix instead. In postfix main.cf, I've added:
virtual_alias_maps = pcre:/etc/postfix/virtual
And then I've created a file at /etc/postfix/virtual that contains
In /etc/aliases, I've added:
#/etc/aliases mailin: "|/var/mail/mailcatch.py"
And then my mailcatch.py contains the python script above. I also created a new user called "mailin".