Automatic archiving of IMAP mailbox

I was looking for a way to let my IMAP server automatically move old mail to the correct IMAP folder based on a given specification. I wanted to simply drag mail that I wanted archived to a IMAP folder called Archives, and then let the server put it in the correct subfolder itself. Inspired by http://wiki.dovecot.org/HowTo/RefilterMail , I wrote this Python script:

#!/usr/bin/python
import imaplib, re, os

server = imaplib.IMAP4('localhost')
server.login('username', 'password')
r = server.select('Archives')
resp, items = server.search(None, 'ALL')

for m in items[0].split():
        resp, data = server.fetch(m, '(BODY[HEADER.FIELDS (SUBJECT FROM TO)])')
        _, headers = data[0]

        dst = None
        if re.search('To: .*@student.dtu.dk', headers): dst = 'Archives.2010.DTU'
        if re.search('Subject: .*\[somelist\]', headers): dst = 'Archives.2010.Somelist'
        if dst == None: dst = 'Archives.2010'

        resp, data = server.copy(m, dst)
        if resp == 'OK':
                server.store(m, '+Flags', '\\Deleted')

server.expunge()

You can obscure the password by using base64.b64decode to prevent people seeing you password when looking over your shoulder.

To make the script run automatically every time a mail is dropped to the Archives folder, use incron. Type incrontab -e and write the following line

/home/username/Maildir/.Archives/cur/ IN_MOVED_TO,IN_ONESHOT python /path/to/script

Where /path/to/script here is the path of the above Python script.

Also, if you want to use this automatic triggering, add the following line to the end of the Python script

os.system('incrontab --reload')

Rogue DHCP detector in Nagios

This Python script I created can be used with Nagios to warn if there are unauthorized DHCP servers on the network. No third party libraries are used.

At the moment the script only checks at IP level, and does not return the MAC address of the rogue server. My plan is to expand this at some stage, but at the moment we do not really need this in our setup.

#!/usr/bin/python
from socket import *
from binascii import *
from random import *
from struct import *

# local machine mac address
chaddr = unhexlify('001122334455')

# allowed dhcp servers
whitelist = set(['11.22.33.44'])

# random session id (xid)
xid = pack('L', randrange(0, 2**32 - 1 ))

# setup socket
s = socket(AF_INET, SOCK_DGRAM)
s.bind(('0.0.0.0', 68))
s.setsockopt(SOL_SOCKET, SO_BROADCAST, 1)

request = \
    '\x01\x01\x06\x00' \
    + xid \
    + ''.ljust(20, '\x00') \
    + chaddr.ljust(16, '\x00') \
    + ''.ljust(192, '\x00') \
    + '\x63\x82\x53\x63' \
    + '\x35\x01\x03' \
    + '\xff'
s.sendto(request, ('255.255.255.255', 67))

# listen for dhcp packets for max 2.5 seconds
status = "OK - No rogue dhcp servers detected"
r = 0
s.settimeout(2.5)
while 1:
    try:
        buf, (ip, port) = s.recvfrom(65565)
    except:
        break
    opcode, = unpack_from('B', buf)
    if not (ip in whitelist and opcode == 0x02):
        r = 2
        status = "CRITICAL - Rogue dhcp server detected on IP-addr: " + ip
        break

s.close()
print status
exit(r)