From: Craig Sanders (no email)
Date: Wed Dec 01 2004 - 19:40:36 EST
On Wed, Dec 01, 2004 at 08:15:10AM -0800, Robin Lynn Frank wrote:
> There was a perl script watch-maillog.pl that was posted here a couple
> of weeks ago. Check the list archives.
but don't use the version i posted to the list, download the latest version
from http://taz.net.au/postfix/
it fixes a few bugs that were in the one i originally posted.
there's also a tiny summarise-watchmaillog.sh script there which tells you
which IP addresses were blocked, how many times, and how many seconds the last
time it was blocked
e.g.
# summarise-watchmaillog.sh | tail
222.101.15.127 x8 76800
222.101.15.146 x8 76800
222.101.15.158 x8 76800
222.101.15.188 x8 76800
222.101.15.48 x8 76800
222.101.15.64 x8 76800
222.101.15.83 x8 76800
222.101.7.211 x8 76800
222.101.7.223 x8 76800
61.19.33.234 x8 76800
this summary tells me i should just permanently block 222.101.15/24, and
probably 222.101.7/24 and 61.19.33.234/32.
BTW, that url above is where the latest versions of all my postfix scripts can
always be found. they get updated automatically whenever i make changes - a
Makefile checks them in to RCS and updates the published web version
automatically.
> BTW, it works quite well and can easily be modified to suit your
> needs.
thanks :)
craig
-- craig sanders <> (part time cyborg)
|
|
|