Python – Postfix catch-all email, save to combined file

postfixpython

We're running a spam trap / honeypot, and by using the amazing guidance of the members here, I've been able to configure our Ubuntu server running Postfix 2.11.0 to catch all inbound email, regardless of destination address, and send the email to a python script which in turn writes the email to a file. The python script looks like:

#!/usr/bin/env python
import sys
import email
import os
import datetime

em = email.message_from_file(sys.stdin) # Read message from Std Input

strFilename = datetime.datetime.now().strftime('%Y%m%d%H%M%S') + ".eml"

output = open('/var/mail/' + strFilename, 'w')
output.write(str(em))
output.close()

My question is: when we receive an email with two or more recipients, the python script is writing two (or more) .eml files instead of 1 file with both recipients listed. I've compared the .eml files, and they're identical with the exception of 1 line in the header of each file. For example, if I personally send an email to our honeypot collector with a TO address of soccer12@example.com, and a CC to soccer34@example.com, the only difference in each file is one line that looks like:

X-Original-To: soccer12@example.com

and the other

X-Original-To: soccer34@example.com

Is there anyway to write only one file with both X-Original-To: fields listed?

Edit:
Additional info: SMTP-sink does what we need, and is the path that we're currently running with, but we're hoping to use postfix instead. In postfix main.cf, I've added:

virtual_alias_maps = pcre:/etc/postfix/virtual

And then I've created a file at /etc/postfix/virtual that contains

/.*/                        mailin

In /etc/aliases, I've added:

#/etc/aliases
mailin:  "|/var/mail/mailcatch.py"

And then my mailcatch.py contains the python script above. I also created a new user called "mailin".

Best Answer

I'm afraid that the answer of your question

Is there anyway to write only one file with both X-Original-To: fields listed?

is

NO


Postfix use X-Original-To header to perform recipient duplication. Of course, you can make postfix write only one file by configure this parameter via main.cf

enable_original_recipient = no

The side effect is you will lose original recipient record in both message and maillog.

reference