In our mail server we are taking lots of hits. In the maillog there are lots of these:
Apr 23 04:35:13 mail1 postfix/smtpd: NOQUEUE: reject: RCPT from unknown[220.127.116.11]: 554 <email@example.com>: Recipient address rejected: User unknown in local recipient table; from=<firstname.lastname@example.org> to=<email@example.com> proto=ESMTP helo=<localhost>
I have a script which searches for the IPs and block those. I'm having a problem when I IP block the RCPT IP's. Instead I want to block the senders domain, like in this example: shareme.com. What should I modify in my script to do this?
#!/bin/bash IPT=/sbin/iptables LIMIT=10 cd /admin # first get one minute of log grep "`date +"%b %d %H:%M:" --date="1 minutes ago"`" /var/log/maillog > minutelog # now extract the rejected attempts, sort and count uniq ip cat minutelog | grep "reject:" | cut -d" " -f10 | cut -d"[" -f2 | cut -d"]" -f 1 | sort | uniq -c | sort -n | sed 's/^[ \t]*//' > tmp1 # for each line in result while read line do MYCOUNT=`echo $line | cut -d" " -f1` MYIP=`echo $line | cut -d" " -f2` if [ $MYCOUNT -lt $LIMIT ] ; then echo $MYIP is ok: $MYCOUNT attempts else echo blocking the spammer at $MYIP with $MYCOUNT attempts $IPT -I INPUT -i eth0 --proto tcp -s $MYIP --destination-port 25 -j DROP echo $MYIP >> blocked.smtp fi done < tmp1 rm -f minutelog rm -f tmp1