The FreeBSD Diary

The FreeBSD Diary (TM) Remember
I remember
[ HOME | TOPICS | INDEX | WEB RESOURCES | BOOKS | CONTRIBUTE | SEARCH | FEEDBACK | FAQ | FORUMS ]

Scripts / handy tips
 New Topic  |  Go to Top  |  Go to Topic  |  Search  |  Log In   Newer Topic  |  Older Topic 
 Adding unknown hosts into spamdb
Author: Dan 
Date:   29-11-08 22:32

I run pf and spamdb for greylisting. Many hosts get through the greylisting only to have bad DNS. I use postfix and make use of the reject_unknown_client_hostname option in my smtpd_client_restrictions directive. As such, I frequently see mail connections such as this:

Nov 29 00:07:19 nyi postfix/smtpd[85071]: NOQUEUE: reject: CONNECT from unknown[216.226.129.231]: 450 4.7.1 Client host rejected: cannot find your hostname, [216.226.129.231]; proto=SMTP

Today I decided to gather up those IP addresses and trap them in spamdb. They will stay there for 24 hours.

grep "Client host rejected: cannot" /var/log/maillog | awk '{print $10}' | cut -d '[' -f 2 | cut -d ']' -f 1 | sort | uniq | xargs -J % -n 1 sudo spamdb -ta %

Hope that helps. :)

--
Webmaster

Reply To This Message
 
 Re: Adding unknown hosts into spamdb
Author: Dan 
Date:   29-11-09 19:42

I have an improvement:

grep 'RCPT from unknown' /var/log/maillog | grep 'Client host rejected: cannot find your hostname' | awk '{print $10}' | cut -d '[' -f 2 | cut -d ']' -f 1 | sort | uniq | xargs -J % -n 1 ${SPAMDB} -ta %

Why? I was getting this error:

spamdb: invalid ip address delays=0.01/0/11/0.17,

Debugging it, I found this:

Nov 29 18:12:59 supernews postfix/smtp[39989]: 3988017083: to=<tosa@example.ua>, relay=mail.example.ua[91.199.106.3]:25, delay=11, delays=0.01/0/11/0.17, dsn=4.7.1, status=deferred (host mail.example.ua[91.199.106.3] said: 450 4.7.1 Client host rejected: cannot find your hostname, [206.127.23.226] (in reply to RCPT TO command))

Ahh, they cant find MY hostname. That's OK. Thus, I started to refine my script, avoiding the error.

--
Webmaster

Reply To This Message
 Forum List  |  Threaded View   Newer Topic  |  Older Topic 


 Forum List  |  Need a Login? Register Here 
 User Login
 User Name:
 Password:
 Remember my login:
   
 Forgot Your Password?
Enter your email address or user name below and a new password will be sent to the email address associated with your profile.
How to get the most out of the forum

phorum.org