Find exim account sending lots of emails. (Spamming)

Question

I have an Exim server with several domains configured. In each domain I have several email accounts. From time to time a computer configured with one of this emails gets infected and starts sending spam.

I use to have Isoqlog to get reports of the top sendin email accounts, but it does not work any mor since it was las updated in 2005.

I need a way to find out the top 50 spamming email accounts in the last 24 hs (not the sender, the account that is being used to authenticate to send spam. The sender can be fake so is no valid data)

Any idea if there is a package (like Isoqlog or similar)that can do this? Thanks

Answer 1

You don't need a complex program to extract information from the log file. An Exim4 log line for incoming mail looks like this:

2020-01-18 02:19:41 1iscm4-0000Nt-TE <= [email protected]\
H=verified_rdns.example.net (helo.example) [192.0.2.1] P=esmtpsa\
X=TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128 CV=no A=dovecot_gssapi:auth_user\
S=3812 [email protected]

with the envelope sender [email protected], the sending host H=verified_rdns.example.net (helo.example) [192.0.2.1] and a list of tag=value.

We are mostly interested in the A tag which has a value of the form authenticator:auth_user, where authenticator is the name of the Exim4 authenticator you gave in the config file and auth_user is the authenticated user.

Putting everything together, we can print the count of e-mails sent by each user in the time spanned by the log file using a simple bash script:

#!/bin/bash 
if [ $# -lt 1 ]; then
    2>& echo Usage: $0 "<exim_mainlog_file>"
    2>& echo Example: $0 /var/log/exim4/mainlog
    exit 1
fi
# To save typing
d='[[:digit:]]'
a='[[:alnum:]]';
pref="^$d\{4\}-$d\{2\}-$d\{2\} $d\{2\}:$d\{2\}:$d\{2\} $a\{6\}-$a\{6\}-$a\{2\}"
logfile="$1"

zgrep "$pref <=" "$logfile" |
grep -oh "A=[[:alnum:]_]\+:[[:alnum:]_]\+" |
cut -d : -f 2 |
sort |
uniq -c |
sort -rn