@@ -19,6 +19,8 @@ EMAIL_FROM = 'ADD_YOUR_RETURN_EMAIL_HERE' ####### ADD YOUR ACTUALL EMAIL ADDR EMAIL_SUBJECT = 'Security Alert - Your Server May Have Been Hacked!' # Leave empty to not send a mail to a CC address CC = '' +# Same as for the CC address, you probably only need one of these +BCC = '' #LOG_FILE = SSHD's log file ###### UPDATE THIS TO YOUR ACTUAL SSHD LOG FILE LOCATION ##### LOG_FILE = '/var/log/sshd/*' @@ -56,9 +58,11 @@ end def get_email_message(to_address, offender, evidence) to_cc = CC.length > 0 ? "\nCC: #{CC}" : '' + to_bcc = BCC.length > 0 ? "\nBCC: #{BCC}" : '' + email_message = <<EOF From: #{EMAIL_FROM} -To: #{to_address}#{to_cc} +To: #{to_address}#{to_cc}#{to_bcc} Subject: #{EMAIL_SUBJECT} Date: #{time2str(Time.now)} @@ -139,8 +143,9 @@ raise "No evidence found for #{host}. Aborting" unless evidence && (evidence.len sent = eval("`#{CAT_BIN} #{EMAIL_LOG_FILE} | #{GREP_BIN} #{host}`").strip raise "Host #{host} has already been reported. Not reporting again." if sent && sent.length > 0 -#are we CCing ourselves? +#are we CC/BCCing ourselves? contacts << CC if CC.length > 0 +contacts << BCC if BCC.length > 0 #by the time we get here we have evidence against a newly reported host Net::SMTP.start(SMTP_SERVER, SMTP_PORT) do |smtp| notify_isp.rb 7602dcd96e252fd8e95f0c5a8a3d0e9aaa7226ad c926c87f8284f9fb5c366203d43cc412c7744f05 Nazar Aziz nazar@panthersoftware.com http://github.com/nazar/report-hack-isp/commit/a07eaa2760ff11bed03f23c85f0999b131b52a09 a07eaa2760ff11bed03f23c85f0999b131b52a09 2008-07-25T10:18:01-07:00 2008-07-25T10:18:01-07:00 Merge remote branch 'nik/mail_to_bcc' aedc313f9c81f3659656595d7ab93a0d458ca12e Nazar Aziz nazar@panthersoftware.com