1

I'd like to log the message id, client ip address & authenticated sender with each SMTP transaction, pretty much as discussed here:

Logging auth information in sendmail

I've implemented the solution, however, it logs all transactions, not just ones that used authentication. I would prefer to log only entries where authentication was used.

My goal is to be able to detect phished email accounts by log analysis.

Entries I'd like to keep look like this:

Sep 23 06:31:40 mail sm-mta[20443]: r8NDVdM3020443: Authenticated-by:LOGIN,username,0,,[192.168.1.10]

Entries I want to skip are missing the mechanism and username (,,,,):

Sep 23 06:31:44 mail sm-mta[20475]: r8NDVh3m020475: Authenticated-by:,,,,messagent.computerdealernews.com.

What I'm mainly looking for is the message id, auth username, and the sender's IP address, on one line. It doesn't seem to have the right IP address.

If you could point me to any reference information on this, that would help.

Working Configuration

This configuration prints out what I want. 

Scheck_data
R$* $: <$&{auth_authen}> $1
R<$+> $*    $: <$1> $2 $(log Authenticated-by: $&{auth_type}, $&{auth_authen}, $&{client_addr}, $&{f} $)
R<$*> $*    $: $2

I found the client_addr and other macros on an IBM sendmail site.

Thanks.

Improve this question
2
  • Could you post examples of generated log entries you want to keep and avoid?
    – AnFi
    Sep 9, 2013 at 23:44
  • I've edited the original question with examples.
    – KIsmay
    Sep 23, 2013 at 17:30

1 Answer 1

Reset to default
2

The code below should generetae log entries only when ${auth_authen} is not empty.
WARNING: Put tabs (\t) before $: [I could not do it]

LOCAL_RULESETS
Scheck_data
R$*       $: <$&{auth_authen}> $1
R<$+> $*  $: <$1> $2 $(log Authenticated-by: $&{auth_type}, $&{auth_authen}, $&{auth_ssf}, $&{auth_author}, $&{mail_mailer}, $&{mail_host}, $&{mail_addr} $)
R<$*> $*  $: $2
Improve this answer
2
  • I might be putting the tabs in the wrong place, but I added them before each $: on all 3 lines. Sendmail errors: Sep 23 10:32:55 mail sm-mta[20468]: NOQUEUE: SYSERR(root): /etc/mail/sendmail.cf: line 1921: Inappropriate use of $1-$9 on LHS Sep 23 10:32:55 mail sm-mta[20468]: NOQUEUE: SYSERR(root): /etc/mail/sendmail.cf: line 1921: replacement $2 out of bounds
    – KIsmay
    Sep 23, 2013 at 17:34
  • Thank you for the hint. I think I have corrected the error in the last line.
    – AnFi
    Sep 24, 2013 at 5:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .