fullauto2012 ,
I feel your pain! I've been fighting
serious MX abuse for about 4 half mos, now. In that time I have accumulated ~12 million SPAM/ABUSE sources! Who knew I'd be such a popular target!
Anyway I
swear by
pf(4) as the
difinitive defense against NET related abuse. Not only does it turn the abusers off, it squelches all (most) of the noise in your log(s), and trims traffic; giving you more of that pipe for yourself. Anyway I'll try to give some clues to creating the necessary
pf(4) stuff you'll need/want, as well as some scripting to help you automate the entire process.
first up; you'll want to gather the offending IP's from your maillog,
without plucking them out manually in your log viewer.
Based on the log output you've posted here; the following should do it for you:
Code:
#!/bin/sh -
cat /var/log/maillog | grep 'did not issue' | awk '{print $5;}' | sed 's/sm-mta\[//' | sed 's/\]//' | sort -t. +0 -1n +1 -2n +2 -3n +3 -4n | uniq >./SPAMMERS
I'd strongly recommend running this from the
/tmp folder/directory. So you can experiment, and ensure that it's capturing the addresses properly. If all goes well. Report back, and we'll move on to the next step(s); a
pf.conf(5) file, and all the related goodies. OH! I mean report back regardless.
Ultimately, the above script will gather all the offending IP's, and sort them in a more readable fashoin, where we can ultimately add them to a TABLE for
pf(4) to read, so it can deal with them in a manner
you find appropriate.
HTH
--Chris
