spamassassin

t0bias · 04-10-2008, 06:24 AM

Hi,

I've got a postfix-mailserver in combination with spamassassin.
It checks, whether a local mailbox exists and if not rejects the smtp-request
immediately.
is it possible to block a senders ip-address let's say for an hour or a day or so,
if there was a certain amount of rejects?
so for example if a spammer tryies
a@..., b@..., c@..., d@...
the spammer's ip gets blocked for some hours and there will no smpt-session
opened at all from this ip any more during this blocking-period?

thanks,

toby

p_s_shah · 04-11-2008, 12:53 PM

Hi there,

I am not aware of any in built mechanism in spamassassin through which you can achieve.

For an alternate solution you can right down a script which can do following :
1. Monitor you log files, for each reject, there will be a corresponding entry in log file.
2. Keep a counter of IP address and no. of rejects. Define a threshold for no. of rejects.
3. If no. of rejects exceeds than threshold, run iptables command with respective parameters to block IP address.

Just update, if it solves your problem.