Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

In our mail server we are taking lots of hits. In the maillog there are lots of these:

Apr 23 04:35:13 mail1 postfix/smtpd[31700]: NOQUEUE: reject: RCPT from unknown[119.153.14.231]: 554 <bob@domainname.net>: Recipient address rejected: User unknown in local recipient table; from=<hareme.com@shareme.com> to=<bob@domainname.net> proto=ESMTP helo=<localhost>

I have a script which searches for the IPs and block those. I'm having a problem when I IP block the RCPT IP's. Instead I want to block the senders domain, like in this example: shareme.com. What should I modify in my script to do this?

#!/bin/bash
IPT=/sbin/iptables
LIMIT=10
cd /admin
# first get one minute of log
grep "`date +"%b %d %H:%M:" --date="1 minutes ago"`" /var/log/maillog > minutelog
# now extract the rejected attempts, sort and count uniq ip
cat minutelog | grep "reject:" | cut -d" " -f10 | cut -d"[" -f2 | cut -d"]" -f 1 | sort | uniq -c | sort -n | sed 's/^[ \t]*//' > tmp1
# for each line in result
while read line
do
MYCOUNT=`echo $line | cut -d" " -f1`
MYIP=`echo $line | cut -d" " -f2`
if [ $MYCOUNT -lt $LIMIT ] ;
then
echo $MYIP is ok: $MYCOUNT attempts
else
echo blocking the spammer at $MYIP with $MYCOUNT attempts
$IPT -I INPUT -i eth0 --proto tcp -s $MYIP --destination-port 25 -j DROP
echo $MYIP >> blocked.smtp
fi
done < tmp1
rm -f minutelog
rm -f tmp1
share|improve this question
    
Deleted, didn't notice count in script. –  AlexD Apr 24 '11 at 4:02

2 Answers 2

up vote 0 down vote accepted

It is impossible to block by SMTP sender domain using only IP filter because e-mail with given domain could originate from any IP. Moreover it is dangerous to block by sender domain at all because anyone could spoof sender e-mail and send multiple messages with something like somebody@google.com and your script will happily block all traffic from gmail.

To solve your problem I recommend checking section "Measures against clients that make too many connections" in http://www.postfix.org/TUNING_README.html

share|improve this answer
    
Thanks for the advice. –  Saif Apr 24 '11 at 6:27

It's better to try Fail2ban: http://www.fail2ban.org/

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.