shiva-spampot / shiva

Spam Honeypot with Intelligent Virtual Analyzer
MIT License
131 stars 36 forks source link

Analyzer loop #25

Open agaglia opened 7 years ago

agaglia commented 7 years ago

Hi, my analyzer print logs as the following:

_2017-01-26 12:52:47,806 - root - DEBUG - Removed '1485431546.M878818P3396Q598774.shiva' key from queue. 2017-01-26 12:52:47,807 - root - DEBUG - Pulled message with key: '1485431536.M494625P3396Q597306.shiva' off 2017-01-26 12:52:47,807 - root - DEBUG - Message received from Peer: '/home/socadmin/shiva-installer/shiva/queue/', From: u'from_email@domain.com.br', to To [u'destination_email@domain.com.br']. 2017-01-26 12:52:47,807 - routing - DEBUG - Matched u'destination_email@domain.com.br' against NEW_USER. 2017-01-26 12:52:47,807 - routing - DEBUG - Message to set([u'destination_email@domain.com.br']) was handled by app.handlers.sample.NEW_USER 2017-01-26 12:52:47,807 - routing - DEBUG - Matched u'destination_email@domain.com.br' against FORWARD. 2017-01-26 12:52:47,813 - routing - DEBUG - Message to set([u'destination_email@domain.com.br']) was handled by app.handlers.sample.FORWARD 2017-01-26 12:52:47,813 - root - DEBUG - Removed '1485431536.M494625P3396Q597306.shiva' key from queue. 2017-01-26 12:52:47,813 - root - DEBUG - Pulled message with key: '1485431535.M765408P3396Q597219.shiva' off 2017-01-26 12:52:47,814 - root - DEBUG - Message received from Peer: '/home/socadmin/shiva-installer/shiva/queue/', From: u'from_email@domain.com.br', to To [u'destination_email@domain.com.br']. 2017-01-26 12:52:47,814 - routing - DEBUG - Matched u'destination_email@domain.com.br' against NEW_USER. 2017-01-26 12:52:47,814 - routing - DEBUG - Message to set([u'destination_email@domain.com.br']) was handled by app.handlers.sample.NEW_USER 2017-01-26 12:52:47,814 - routing - DEBUG - Matched u'destination_email@domain.com.br' against FORWARD. 2017-01-26 12:52:47,821 - routing - DEBUG - Message to set([u'destination_email@domain.com.br']) was handled by app.handlers.sample.FORWARD 2017-01-26 12:52:47,821 - root - DEBUG - Removed '1485431535.M765408P3396Q597219.shiva' key from queue. 2017-01-26 12:52:47,821 - root - DEBUG - Pulled message with key: '1485431529.M580682P3396Q596403.shiva' off 2017-01-26 12:52:47,822 - root - DEBUG - Message received from Peer: '/home/socadmin/shiva-installer/shiva/queue/', From: u'from_email@domain.com.br', to To [u'destination_email@domain.com.br']. 2017-01-26 12:52:47,822 - routing - DEBUG - Matched u'destination_email@domain.com.br' against NEW_USER. 2017-01-26 12:52:47,822 - routing - DEBUG - Message to set([u'destination_email@domain.com.br']) was handled by app.handlers.sample.NEW_USER 2017-01-26 12:52:47,822 - routing - DEBUG - Matched u'destination_email@domain.com.br' against FORWARD. 2017-01-26 12:52:47,828 - routing - DEBUG - Message to set([u'destination_email@domain.com.br']) was handled by app.handlers.sample.FORWARD 2017-01-26 12:52:47,828 - root - DEBUG - Removed '1485431529.M580682P3396Q596403.shiva' key from queue. 2017-01-26 12:52:47,829 - root - DEBUG - Pulled message with key: '1485431543.M276145P3396Q598275.shiva' off 2017-01-26 12:52:47,829 - root - DEBUG - Message received from Peer: '/home/socadmin/shiva-installer/shiva/queue/', From: u'from_email@domain.com.br', to To [u'destination_email@domain.com.br']. 2017-01-26 12:52:47,829 - routing - DEBUG - Matched u'destination_email@domain.com.br' against NEW_USER. 2017-01-26 12:52:47,830 - routing - DEBUG - Message to set([u'destination_email@domain.com.br']) was handled by app.handlers.sample.NEW_USER 2017-01-26 12:52:47,830 - routing - DEBUG - Matched u'destination_email@domain.com.br' against FORWARD. 2017-01-26 12:52:47,836 - routing - DEBUG - Message to set([u'destination_email@domain.com.br']) was handled by app.handlers.sample.FORWARD 2017-01-26 12:52:47,836 - root - DEBUG - Removed '1485431543.M276145P3396Q598275.shiva' key from queue. 2017-01-26 12:52:47,837 - root - DEBUG - Pulled message with key: '1485431544.M631310P3396Q598473.shiva' off 2017-01-26 12:52:47,837 - root - DEBUG - Message received from Peer: '/home/socadmin/shiva-installer/shiva/queue/', From: u'from_email@domain.com.br', to To [u'destination_email@domain.com.br']. 2017-01-26 12:52:47,837 - routing - DEBUG - Matched u'destination_email@domain.com.br' against NEW_USER. 2017-01-26 12:52:47,838 - routing - DEBUG - Message to set([u'destination_email@domain.com.br']) was handled by app.handlers.sample.NEW_USER 2017-01-26 12:52:47,838 - routing - DEBUG - Matched u'destinationemail@domain.com.br' against

My shiva.conf file:

_[global] Path for Receiver to dump mails and Analyzer to retrieve spams from

queuepath : /home/socadmin/shiva-installer/shiva/queue/

[receiver] Host to listen on for incoming spams. It could be NATed or Public IP

listenhost : 127.0.0.1 Port for running SMTP receiver (integer value only)

listenport : 2525 Name of the sensor

sensorname : shiva Boolean value to enable/disable SMTP Authentication. (True/False)

authenabled : False Username(s) for SMTP AUTH. Combination of user1:pass1, user2:pass2 .... userN:passN would work e.g. smtpuser : user1,user2,user3,userN (no space, just comma separated)

smtpuser : user Password(s) for SMTP AUTH e.g. smtppasswd : pass1,pass2,pass3,passN (no space, just comma separated)

smtppasswd : password

[analyzer] Enable/disable relaying of spams. Beware! Do not disable relaying and do not relay too much

relay : False Number of times an individual spam is to be relayed (integer)

individualcounter : 30 Number of total spams to be relayed in a specific time (integer value only)

globalcounter : 120 The port on which exim is listening (integer value only)

relayport : 2525 Host on which exim is listening

relayhost : 127.0.0.1 Path where distorted spam(s), which could not be analyzed, would be dumped

undeliverable_path : /home/socadmin/shiva-installer/shiva/distorted/ Duration (in minutes) to be passed to shivascheduler (integer value only)

schedulertime : 5 Path where raw spam samples would be dumped

rawspampath : /home/socadmin/shiva-installer/shiva/rawspams/ Path to dump attachments

attachpath : /home/socadmin/shiva-installer/shiva/attachments/ Path to dump inline attachments

inlinepath : /home/socadmin/shiva-installer/shiva/attachments/inlines/

[database] Store data in local databases (True/False)

localdb : True MySQL host to connect

host : 127.0.0.1 MySQL username

user : root MySQL password

password : XXXXXXXXXXX

[hpfeeds] Boolean value to enable/disable hpfeeds (True/False)

enabled : False Hpfeeds host

host : hpfriends.honeycloud.net Hpfeeds port (integer value only)

port : 20000 Ident for hpfeeds

ident : wN7TesWe Secret key for hpfeeds

secret : 8koAbA4P0PMhnW9Q Path where raw spam samples published on hpfeeds would be dumped

hpfeedspam : /home/socadmin/shiva-installer/shiva/rawspams/hpfeedspam/ Path where attachments published on hpfeeds would be dumped

hpfeedattach : /home/socadmin/shiva-installer/shiva/attachments/hpfeedattach/

[notification] Boolean value to enable/disable notification email to developer/maintainer (True/False)

enabled : False sender email-id (any mail-id shall work; even the bogus ones)

sender : my.spamp0t@anydomain.com recipient email-id (suggested to be of developer / maintainer)

recipient : b0nd.g4h@gmail.com_

Any idea? THX