Home / server / Questions / 262732
Accepted
Minhaj
Asked: 2011-04-24 01:24:24 +0800 CST

Blocking sender domain from maillog

  • 772

In our mail server we are taking lots of hits. In the maillog there are lots of these:

Apr 23 04:35:13 mail1 postfix/smtpd[31700]: NOQUEUE: reject: RCPT from unknown[119.153.14.231]: 554 <[email protected]>: Recipient address rejected: User unknown in local recipient table; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<localhost>

I have a script which searches for the IPs and block those. I'm having a problem when I IP block the RCPT IP's. Instead I want to block the senders domain, like in this example: shareme.com. What should I modify in my script to do this?

#!/bin/bash
IPT=/sbin/iptables
LIMIT=10
cd /admin
# first get one minute of log
grep "`date +"%b %d %H:%M:" --date="1 minutes ago"`" /var/log/maillog > minutelog
# now extract the rejected attempts, sort and count uniq ip
cat minutelog | grep "reject:" | cut -d" " -f10 | cut -d"[" -f2 | cut -d"]" -f 1 | sort | uniq -c | sort -n | sed 's/^[ \t]*//' > tmp1
# for each line in result
while read line
do
MYCOUNT=`echo $line | cut -d" " -f1`
MYIP=`echo $line | cut -d" " -f2`
if [ $MYCOUNT -lt $LIMIT ] ;
then
echo $MYIP is ok: $MYCOUNT attempts
else
echo blocking the spammer at $MYIP with $MYCOUNT attempts
$IPT -I INPUT -i eth0 --proto tcp -s $MYIP --destination-port 25 -j DROP
echo $MYIP >> blocked.smtp
fi
done < tmp1
rm -f minutelog
rm -f tmp1
scripting spam postfix

2 Answers

  1. It's better to try Fail2ban: http://www.fail2ban.org/

    Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

    • 1
  2. Best Answer

    It is impossible to block by SMTP sender domain using only IP filter because e-mail with given domain could originate from any IP. Moreover it is dangerous to block by sender domain at all because anyone could spoof sender e-mail and send multiple messages with something like [email protected] and your script will happily block all traffic from gmail.

    To solve your problem I recommend checking section "Measures against clients that make too many connections" in http://www.postfix.org/TUNING_README.html

    • 1