<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=utf-8">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>If you are using MailScanner you should look into a program
called Vispan. IT scans the maillog and compiles lists of ips to automatically
block according to whatever criteria you put in place. The good thing is that
it releases the ip after 5 days as most spammers are using DHCP, but if the
same machines starts to spam again it then blocks it for 10 days and so for and
so long. Also has a nice little web based stats page.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info]
<b>On Behalf Of </b>Vincent Verhagen<br>
<b>Sent:</b> Wednesday, April 28, 2010 12:10 AM<br>
<b>To:</b> MailScanner discussion<br>
<b>Subject:</b> Re: OT: Blocking persistent spammers using IPTables?<o:p></o:p></span></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p>Don't see a big issue there. As long as you pick the number of
transgressions relatively high and your expiry time reasonable. I've been
thinking about this for a while, but don't do it because it would mess up the
statistics I provide for management to "prove the need for funding".<o:p></o:p></p>
<p>I am doing this for ssh and pop3/imap, using SEC to auto-create iptables
rules, to stop brute force attacks.<o:p></o:p></p>
<p> <o:p></o:p></p>
<p>On Tue, 27 Apr 2010 20:22:08 +0100, Jason Ede
<J.Ede@birchenallhowden.co.uk> wrote:<o:p></o:p></p>
<blockquote style='border:none;border-left:solid #1010FF 1.5pt;padding:0in 0in 0in 4.0pt;
margin-left:3.75pt;margin-top:5.0pt;margin-bottom:5.0pt'>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>We’re
debating blocking (using IPTables) IP’s that register more than a set number of
rejections (554 from spamhaus and other blacklists or persistently try random
address@domain). Before we actually implement this I’m wondering if there can
be any problems with this method? It will only be used for IP’s that try to
connect a significant number of times and we’ll have an expiry on each IP so
the blocklist doesn’t keep growing indefinitely.<o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Jason<o:p></o:p></p>
</div>
</blockquote>
<p> <o:p></o:p></p>
</div>
</body>
</html>