From dd356c3cef1d735b83c2f1f6db217a1099efaf57 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 1 Dec 2013 19:08:28 +1100
Subject: [PATCH] BF: fixed for sendmail and tested the MTA aspects of this
 action

---
 config/action.d/xarf-login-attack.conf | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/config/action.d/xarf-login-attack.conf b/config/action.d/xarf-login-attack.conf
index c45a9464..6580cd8a 100644
--- a/config/action.d/xarf-login-attack.conf
+++ b/config/action.d/xarf-login-attack.conf
@@ -15,7 +15,7 @@
 # https://github.com/abusix/xarf-specification
 # http://www.x-arf.org/schemata.html
 #
-#
+# Author: Daniel Black
 # Based on complain written by Russell Odom <russ@gloomytrousers.co.uk>
 #
 #
@@ -42,7 +42,7 @@ actionban = ADDRESSES=`querycontacts <ip>`
                 (printf -- %%b "<header>\n<message>\n<report>\n${MATCHES}\n";
                  date '+Note: Local timezone is %%z (%%Z)';
                  tail -n <loglines> <logpath> | grep '[^0-9]<ip>[^0-9]';
-                 printf -- %%b "<footer>") | <mailcmd> "abuse report about <ip> - $DATE" <mailargs> $ADDRESSES
+                 printf -- %%b "<footer>") | <mailcmd> <mailargs> $ADDRESSES
             fi
 
 actionunban =
@@ -50,7 +50,7 @@ actionunban =
 [Init]
 # Option: header
 # Notes:  This is really a fixed value
-header  = Auto-Submitted: auto-generated\nX-XARF: PLAIN\nContent-Transfer-Encoding: 7bit\nContent-Type: multipart/mixed; charset=utf8;\n  boundary=Abuse-bfbb0f920793ac03cb8634bde14d8a1e;\n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8;\n
+header  = Subject: abuse report about $IP - $DATE\nAuto-Submitted: auto-generated\nX-XARF: PLAIN\nContent-Transfer-Encoding: 7bit\nContent-Type: multipart/mixed; charset=utf8;\n  boundary=Abuse-bfbb0f920793ac03cb8634bde14d8a1e;\n\n--Abuse-bfbb0f920793ac03cb8634bde14d8a1e\nMIME-Version: 1.0\nContent-Transfer-Encoding: 7bit\nContent-Type: text/plain; charset=utf-8;\n
 
 # Option: footer
 # Notes:  This is really a fixed value and needs to match the report and header
@@ -70,10 +70,10 @@ message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, whi
 loglines = 9000
 
 # Option:  mailcmd
-# Notes.:  Your system mail command. Is passed 2 args: subject and recipient
+# Notes.:  Your system mail command. It is passed the recipient
 # Values:  CMD
 #
-mailcmd = mail -s
+mailcmd =  /usr/sbin/sendmail
 
 # Option:  mailargs
 # Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
@@ -84,7 +84,7 @@ mailcmd = mail -s
 #              -- -f me@example.com
 # Values:  [ STRING ]
 #
-mailargs =
+mailargs = -f <sender>
 
 # Option:  tlp
 # Notes.:  Traffic light protocol defining the sharing of this information.