haraka/haraka-plugin-p0f

# p0f - passive OS fingerprints
#
# Ubuntu Upstart script (place in /etc/init and run "initctl start p0f")
# tested with Ubuntu 14.04
#
# Contributed by @mattsimerson
#

description   "p0f - passive OS fingerprint"

start on net-device-up IFACE=eth0
stop on runlevel [016]

respawn
respawn limit 10 5
umask 022
limit nofile 65535 65535

console none

pre-start script
    test -x /usr/sbin/p0f || { stop; exit 0; }
    test -c /dev/null || { stop; exit 0; }
end script

exec /usr/sbin/p0f -f /etc/p0f/p0f.fp -i eth0 -s /tmp/.p0f_socket "dst port 25 or dst port 587 or dst port 465"