Security/Capture

[SB]

Hello, does anyone know if there is an option, or another way to capture all incoming and outgoing emails for an email account?

(Like a security account, to monitor staff etc.) I need to implement this urgently for a client.

I can capture incoming using sieve, although this is not reliable if say an OOO is setup, as it will clear it.

[Scott MacDonald]

No idea without a sieve but as you say the potential for being overwritten is a risk.

A built in blind copy or two levels of sieve filters (admin and user level) would be a nice added feature.

[SH]

The problem is that Sieve is triggered only when email is delivered to local.

It would be better to just create haraka plugin which will crudely copy every processed email to data folder. I am bit hesitant to do this as easily accessed feature because it might violate laws in multiple countries if used, same apply to record "subject" to logs...but it will probably end up implemented (with legal warning) although files will not be viewable through web...

[SB]

Thank you both for the replies.

Previously we have done this on other mail servers by making a rule to copy all incoming and outgoing for a specific mailbox into another mailbox, named [e-mail] where we have been required to implement this.

[SB]

Would a one-way folder sync work for now? set to run every hour

@hourly rsync data/[e-mail]/sent/ to /data/[e-mail]/sent/

[Scott MacDonald]

It might if the user accesses the mailbox with only IMAP and doesn't happen to delete sent messages before your cron job runs again.

[SB]

Thanks Scott, I know it's not perfect, but I just need a solution implementing fast. I will give this a go and see how long the sync takes, maybe make it every 15 mins.

[SB]

Thank you both.

Rsync code if anyone would like it (its quick!)

Function: Copy Mailbox to Mailbox2, don't delete from 2, copy only new/updated files.

Inbox Directory

rsync --ignore-existing -ar --progress /data/domains/<domain>/<mailbox>/Maildir/cur/ /data/domains/<domain>/<destination-mailbox>/Maildir/cur/

Sent Directory

rsync --ignore-existing -ar --progress /data/domains/<domain>/<mailbox>/Maildir/./.Sent/cur/ /data/domains/<domain>/<destination-mailbox>/Maildir/./.Sent/cur/

Sent Items Directory

rsync --ignore-existing -ar --progress "/data/domains/<domain>/<mailbox>/Maildir/./.Sent Items/cur/" "/data/domains/<domain>/<destination-mailbox>/Maildir/./.Sent Items/cur/"

[SH]

fix #523 add inspection plugin

→ <<cset 937eaaaecefa>>

[SB]

Hi SH, thank you for the update! I am just looking at the demo, is the only option to capture email for ALL accounts only? or can we do it for individual mailboxes?