mailpot 0.0.1 → 0.0.2

data/VERSION

@@ -1 +1 @@
-0.0.1
+0.0.2

data/lib/mailpot.rb

@@ -16,7 +16,8 @@ module_function
   :smtp_port => '1025',
   :verbose => false,
   :daemon => true,
-  :key_file => '/etc/mailpot/keys.yml'
+  :key_file => '/etc/mailpot/keys.yml',
+  :banner => '{host} ESMTP'
  }
  
  def parse! arguments=ARGV, defaults=@@defaults

data/lib/mailpot/mail.rb

@@ -5,6 +5,8 @@ require 'socket'
 require 'zlib'
 require 'digest/md5'
 require 'aws'
+require 'mail'
+require 'net/smtp'
 
 module Mailpot::Mail
 module_function
@@ -30,14 +32,30 @@ module_function
   msg[:sender] = message[:sender]
   msg[:source_ip] = message[:ip]
   msg[:recipients] = message[:recipients]
-  # worried about dedupe here and need to come up with a way at 1M messages 
-  # a day this could be a lot of storage
+  msg[:probe] = detect_probe(message)
+  # we must at this point detect probes because we need them to be sent
   encoded_message = Base64.encode64(msg.to_json)
   deflate_encoded_message = gzdeflate(encoded_message)
   digest = Digest::MD5.hexdigest(deflate_encoded_message)
   store_message(digest, deflate_encoded_message)
  end
  
+ def detect_probe(msg)
+  config = Mailpot.get_config
+  mail = Mail.new(msg[:source])
+  # First rule we want to detect is when the ip of the honeypot is in the subject
+  if mail.subject.include? config[:smtp_ip]
+   return [true, forward_probe(msg)]
+  end
+  return [false, false]
+ end
+ 
+ def forward_probe(msg)
+  Net::SMTP.start('localhost') do | smtp|
+   smtp.send_message msg[:source], msg[:sender], msg[:recipients]
+  end
+ end
+ 
  def store_message(key, value)
   Thread.new {
    mail = @s3.buckets[@bucket].objects[key]

data/lib/mailpot/smtp.rb

@@ -1,5 +1,7 @@
 require 'eventmachine'
 require 'socket'
+require 'yaml'
+
 class Mailpot::Smtp < EventMachine::Protocols::SmtpServer
  def current_message
   @current_message ||= {}
@@ -11,7 +13,14 @@ class Mailpot::Smtp < EventMachine::Protocols::SmtpServer
  end
  
  def get_server_greeting
-  "ESMTP Sendmail 8.12.9/8.12.9;"
+  c = Mailpot.get_config 
+  yml = YAML.load_file c[:key_file]
+  host = get_server_domain
+  t = DateTime.now.strftime('%a, %d %b %Y %H:%M:%S %z')
+  banner = yml['banner']
+  banner = banner.gsub('{host}', host)
+  banner = banner.gsub('{date}', t)
+  return banner
  end
  
  def get_server_domain

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: mailpot
 version: !ruby/object:Gem::Version 
-  hash: 29
+  hash: 27
   prerelease: 
   segments: 
   - 0
   - 0
-  - 1
-  version: 0.0.1
+  - 2
+  version: 0.0.2
 platform: ruby
 authors: 
 - Matt Jezorek
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2012-02-15 00:00:00 Z
+date: 2012-02-16 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: activesupport
@@ -62,7 +62,7 @@ dependencies:
   type: :runtime
   version_requirements: *id003
 - !ruby/object:Gem::Dependency 
-  name: rake
+  name: mail
   prerelease: false
   requirement: &id004 !ruby/object:Gem::Requirement 
     none: false
@@ -73,10 +73,10 @@ dependencies:
         segments: 
         - 0
         version: "0"
-  type: :development
+  type: :runtime
   version_requirements: *id004
 - !ruby/object:Gem::Dependency 
-  name: rdoc
+  name: rake
   prerelease: false
   requirement: &id005 !ruby/object:Gem::Requirement 
     none: false
@@ -89,7 +89,21 @@ dependencies:
         version: "0"
   type: :development
   version_requirements: *id005
-description: "  MailPot is a simple SMTP server honeypot that will catch emails and store\n  them deduplicated in a database. This will extract links from emails and do \n  other analysis on it. Once probes can be identified they will be passed.\n"
+- !ruby/object:Gem::Dependency 
+  name: rdoc
+  prerelease: false
+  requirement: &id006 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 0
+        version: "0"
+  type: :development
+  version_requirements: *id006
+description: "  MailPot is a simple SMTP server honeypot that will catch emails and store\n  them in S3 and then pop a message into SQS for later processing\n"
 email: mjezorek@gmail.com
 executables: 
 - mailpot