IPBlock question

[Matthew Baker]

Hi All,

        I have set up the module so entries are being added to the access.db.
This works fine. However the Cronjob perl script copied off the end of
CustomConfig.pm which runs hourly does not seem to remove old entries
properly.

What happens is that if I run strings /etc/mail/access.db I get the
entries for hostnames and IPs added. Then if I run the IPBlock cleaner
and run the strings command again it will sometimes not remove the entry
from the access.db and sometimes remove part of the string. E.g. will
remove the last segment up to the last '.' of an IP or hostname. It does
however seem to remove them from the IPBlock.db file and log that lines
were removed from the access file.

Obvious things I have tried are:
        1. Making sure the $Refusal line matches in the CustomConfig.pm and the
cron script.
        2. I have reduced the $OneHour to 1 so it should in theory remove
entries one second old (just for testing but I have waited an hour and
tested too).
        3. I have rewritten the $Refusal so there are no special chars (:// in
a URL was taken out).
        4. Ran a separate file to the main access.db for testing.

I'm running:
        Fedora Core 1
        MailScanner 4.31.6-1 rpm
        sendmail-8.12.11 (built from src not rpm)
        perl 5.8.3-16 rpm

Incidentally it was doing this in 4.29-7 before I upgraded earlier today.

Thanks in advance.

Matt
--

[root at mail-gw mail]# strings IPBaccess.db
"550 Site blocked by MailScanner due to excessive email see
www.sovision.com"
194.105.69.87
"550 Site blocked by MailScanner due to excessive email see
www.sovision.com"
barney.gwork.org
[root at mail-gw mail]# /usr/local/sbin/IPB
IPBedit.pl        IPBlock-clean.pl
[root at mail-gw mail]# /usr/local/sbin/IPBlock-clean.pl
[root at mail-gw mail]# Jun  4 14:41:29 mail-gw IPBlock[2551]: Deleted 2
entries from sendmail access database

[root at mail-gw mail]# strings IPBaccess.db
"550 Site blocked by MailScanner due to excessive email see
www.sovision.com"
194.105.69.87
"550 Site blocked by MailScanner due to excessive email see
www.sovision.com"
barney.gwork.org

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html