#!/bin/csh
#
# This script notifies customers of how many virus infected
# messages have been stopped for them
#
# YOU MUST MODIFY THIS SCRIPT FOR YOUR SITE.
# 1. replace mydomain.com and MyDomain entries with your local info
# 2. check executable paths for qmail and vpopmail
# 3. Assumes that you use qmail, qmail-scanner, and vpopmail
# 4. Run this monthly in cron after the mailstat.csv log has been rotated
#
# Works for me but no guarantees
# Ed Henderson <ed@certainty.net>
# Aug-22-2003
#
unset noclobber
set nonomatch
#
# get domain list from qmail and strip out unwanted domains
#
set domains=`cat /var/qmail/control/virtualdomains|grep -v bogusdomain|awk -F: '{print $1}'`
set VALIDDOMAINS=""
# string together the domain names
foreach domain ($domains)
   if ("$VALIDDOMAINS" == "") then
      set VALIDDOMAINS="$domain"
   else
      set VALIDDOMAINS="$VALIDDOMAINS|$domain"
   endif
end
#
# now find all virus messages that was stopped on behalf of our customers
# and create the virusreport logfile
# This script runs after the mailstat.csv log has been rotated to
# mailstats.csv.00 which contains the prior month's details
#
cat /var/qmail/qmailscan/mailstats.csv.00|grep -v "Clear:" \
  |cut -f2,6|awk -F, '{print $1}' \
  |egrep "($VALIDDOMAINS)"|awk -F: '{print $2 $3 $4 $5}' \
  |sed -e 's/<//g' -e 's/>//g' -e 's/\&lt\;//g' -e 's///g' \
  |sort -n|uniq -c > /tmp/virusreport.log

#
# Foreach of our users in the logfile send a report to them
#
foreach user (`cat /tmp/virusreport.log|awk '{print $3}'|sort -u`)
   set userdomain=`echo $user|awk -F@ '{print $2}'`
   #
   # Make sure they are valid accounts before sending report to minimize
   # undeliverables due to mangle addresses
   # I use vpopmail's vuserinfo to check for valid account names
   #
   # look to see if account exists
   set userstatus=`/home/vpopmail/bin/vuserinfo $user|awk '{print $1 $2 $3}'`
   # next look to see if account is disabled
   set acctstatus=`/home/vpopmail/bin/vuserinfo $user|grep 'mail will be bounced back'|awk '{print $4}'`
   # if account does not exist or is disabled then don't send report
   if ("$userstatus" == "nosuchuser" || "$acctstatus" == "bounced") then
      echo Invalid email account $user - Virus report not sent.
   else
      # account appears to be valid so send report
      set mailfile=/tmp/virusreport.$user.$$
      echo 'From: "Anti-Virus Report" <anti-virus@mydomain.com>' > $mailfile
      echo "Subject: Monthly Virus report" >> $mailfile
      echo "Hello $user," >> $mailfile
      echo ""  >> $mailfile
      echo "You are receiving this message because you are using the MyDomain" >> $mailfile
      echo "Anit-Virus service. This report is sent monthly to inform you of all virus" >> $mailfile
      echo "infected emails that were stopped on your behalf during the last month." >> $mailfile
      echo "Here is the latest summary:" >> $mailfile
      echo "" >> $mailfile
      echo "Qty. Virus Name or Type">> $mailfile
      echo "==== ==================">> $mailfile
      grep "	$user" /tmp/virusreport.log|cut -f0,1 >> $mailfile
      echo "" >> $mailfile
      echo "" >> $mailfile
      echo "If you have any questions about MyDomain's Anti-Virus service please">> $mailfile
      echo "contact us." >> $mailfile
      echo "" >> $mailfile
      echo "" >> $mailfile
      echo "Compliments of MyDomain Internet Service :-)" >> $mailfile
      /bin/mail -t $user < $mailfile
      /bin/rm -f $mailfile
      echo Virus report sent to $user
   endif
end
#
# Clean up the virusreport logfile
#
#/bin/rm -f /tmp/virusreport.log