OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
spamtrap-built block list

From: Adrian von Bidder (avbidderfortytwo.ch)
Date: Tue May 10 2005 - 14:31:02 CDT


Yo!

Since I have several email addresses receiving nothing but spam, I've
written a small policy daemon that will automatically block IP addresses
sending mail to these adresses.

WARNING WARNING WARNING
I did this as a finger exercise within only a few hours. I do not currently
use this in productive use, and I don't recommend you do that. I'm just
curious if this works at all.
WARNING WARNING WARNING

Key functionality:
 - if the client IP is not in the database, answer with DUNNO
 - if the client IP is in the database and a spam trap was hit less than 30d
ago, answer with 550
 - if the recipient is in the list of spamtrap addresses, add an entry to
the db.

Please see the script attached below (this version does not put itself in
the background - that's a trivial change to make, but I'm not comfortable
with it yet.)

For real use, it would have to be improved:
 - all values are hardcoded right now
 - absolutely silent operation - no logging.
 - dies on error, leaves postfix to go "451 configuration problem" on you.
 - a BerkelyDB expert should probably look over the code and fix the most
obvious problems wrt performance and concurrency. (Currently, the db is
opened and closed for every request.)

Comments welcome. (Oh, and patches, too :-)

<http://fortytwo.ch/~avbidder/autoblacklist/>

And again:

WARNING WARNING WARNING
I did this as a finger exercise within only a few hours. I do not currently
use this in productive use, and I don't recommend you do that. I'm just
curious if this works at all.
WARNING WARNING WARNING

greetings
-- vbi

--
The number of people who tried the Internet and gave
up is equal to the number of Internet users. No other
popular technology has that drop-out rate.
        -- Reed Hundt, then FCC Chair at the ACM'97 conference

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
Comment: get my key from http://fortytwo.ch/gpg/92082481

iKcEABECAGcFAkKBC/pgGmh0dHA6Ly9mb3J0eXR3by5jaC9sZWdhbC9ncGcvZW1h
aWwuMjAwMjA4MjI/dmVyc2lvbj0xLjUmbWQ1c3VtPTVkZmY4NjhkMTE4NDMyNzYw
NzFiMjVlYjcwMDZkYTNlAAoJEIukMYvlp/fWlP8AoOLz++aygMcej+Uvww6Q9z+1
Ve6NAJ4zYbXikF7w72RIzSWJLzvmSRlytQ==
=FO7O
-----END PGP SIGNATURE-----