View Single Post
  #6  
Old 19th November 2008, 14:50
frank2 frank2 is offline
Junior Member
 
Join Date: Nov 2008
Posts: 6
Thanks: 0
Thanked 1 Time in 1 Post
Default

Quote:
failregex = reject: RCPT from (.*)\[<HOST>\]: 550 5.1.1
reject: RCPT from (.*)\[<HOST>\]: 450 4.7.1
reject: RCPT from (.*)\[<HOST>\]: 554 5.7.1

Can I do this in one file. I was not sure so I did a seperate file

I know one thing is for sure . just doing 554 and 550 is working sooo nice. My traffic has slowed down large!. Now I only do this temp 50 mins or so.. i noticed in my logs I was getting alot of already banned. Maybe thats why you run yours permently?

Hows that working out for you. do you get more hits that way. How are the complaints .. Have you lost anymail..

I was thinking of upping the temp time to say a full day beyond that I fear eventualy it could be a ligit email. I have mine testing on a test server I moved over some light traffic domains. One company gets alot of international stuff

Quote:
2008-11-19 08:37:36,745 fail2ban.actions: WARNING [postfix-spamers550] Ban 124.120.191.2
2008-11-19 08:37:37,741 fail2ban.actions: WARNING [postfix] Ban 124.120.191.2
2008-11-19 08:38:49,757 fail2ban.actions: WARNING [postfix] Unban 189.104.220.232
2008-11-19 08:38:49,765 fail2ban.actions: WARNING [postfix-spamers550] Unban 189.104.220.232
2008-11-19 08:39:22,789 fail2ban.actions: WARNING [postfix-spamers550] Ban 61.170.197.7
2008-11-19 08:39:23,785 fail2ban.actions: WARNING [postfix] Ban 61.170.197.7
2008-11-19 08:42:29,801 fail2ban.actions: WARNING [postfix] Ban 221.200.232.222
2008-11-19 08:42:29,805 fail2ban.actions: WARNING [postfix-spamers550] Ban 221.200.232.222
2008-11-19 08:46:28,817 fail2ban.actions: WARNING [postfix] Ban 201.230.186.103
2008-11-19 08:46:28,821 fail2ban.actions: WARNING [postfix-spamers550] Ban 201.230.186.103
If the ipaddress or fake spoofs are common I figure they make it to the lists but if they are tottaly fake random generated info then I could one day miss a important email that would make someone mad ..

Overall the fail2ban with what I did is making a huge diffrence.
Reply With Quote