use iptables to block spammer

[denversteve <sa...@esells.com>]

I am running qmailrocks mail server and have not found a good answer to this
question for blocking IP instead of just processing the spam emails and
overwhelming my server.

Is there someone with a script to modify qmail-scanner-queue.pl or another
script to run /sbin/iptables to block a spam IP address on the first flagged
email, then maybe remove blocks from iptables after a day.
I know the number of ip addresses is huge with the viruses/spyware out there
so I find blocking the ip works great and I would rather have a user with a
fals positive contact me and I can unblock quickly or create a secret web
page they can visit that will remove they block.
My server is getting overwhelmed by spammers with 10K emails in an hour,
blocking countries has helped but not a very good fix.
I am an ASP/VB programmer would like bash or perl script that could run or a
direct mod to qmail scanner would really work great.
-- 
View this message in context: http://www.nabble.com/use-iptables-to-block-spammer-tf4898640.html#a14030467
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: use iptables to block spammer

[Richard Frovarp <ri...@sendit.nodak.edu>]

denversteve wrote:
> I am running qmailrocks mail server and have not found a good answer to this
> question for blocking IP instead of just processing the spam emails and
> overwhelming my server.
>
> Is there someone with a script to modify qmail-scanner-queue.pl or another
> script to run /sbin/iptables to block a spam IP address on the first flagged
> email, then maybe remove blocks from iptables after a day.
> I know the number of ip addresses is huge with the viruses/spyware out there
> so I find blocking the ip works great and I would rather have a user with a
> fals positive contact me and I can unblock quickly or create a secret web
> page they can visit that will remove they block.
> My server is getting overwhelmed by spammers with 10K emails in an hour,
> blocking countries has helped but not a very good fix.
> I am an ASP/VB programmer would like bash or perl script that could run or a
> direct mod to qmail scanner would really work great.
>   

Watch out as legitimate mail servers send out messages that can be 
flagged as spam. You'd be surprised how many people send HTML mail with 
two words, a GIF signature, and no subject to their spouse. I wouldn't 
want to block gmail due to getting one bad message from them.

To help with your problem, use black lists at your MTA. Reputable ones 
do quite a bit of work to make sure there are minimal false positives 
and require more than just one bad email from an IP. You then don't have 
to worry about maintaining the list as they do additions and deletions. 
The sender also gets a reason why they were rejected, instead of not 
being able to communicate with your server. Greylisting, greet pause, 
connection throttling all work as well.

Richard

Re: use iptables to block spammer

[Steven Kurylo <st...@aviawest.com>]

>
> Is there someone with a script to modify qmail-scanner-queue.pl or another
> script to run /sbin/iptables to block a spam IP address on the first flagged
> email, then maybe remove blocks from iptables after a day.
>   
I use fail2ban to block misbehaving hosts - like those that send too 
many spam messages in a row or try too many not existent users.  It 
works by parsing your log files.

http://www.fail2ban.org/

Re: use iptables to block spammer

["John D. Hardin" <jh...@impsec.org>]

On Thu, 29 Nov 2007, denversteve wrote:

> I am running qmailrocks mail server and have not found a good
> answer to this question for blocking IP instead of just processing
> the spam emails and overwhelming my server.
> 
> Is there someone with a script to modify qmail-scanner-queue.pl or
> another script to run /sbin/iptables to block a spam IP address on
> the first flagged email, then maybe remove blocks from iptables
> after a day.

Blackholing on the first spam is a bit extreme...

If you poke around under http://www.impsec.org/~jhardin/antispam/ you
will find a script that I use that adds repeat abusers to the IP block
list (and, in my case, also TCP tarpits their server). "repeat abuse"  
is defined as more than three or four attempts in a limited time from
the same IP address: (1) that I am already blocking via DNSBL, or (2)
to unlikely addresses at my mailing list server, or (3) that get
blocked by explicit sendmail access deny rules. 

The blocks automatically expire after a while, as that IP will no
longer be able to generate sendmail log entries while it's blocked...

This script is sendmail-specific as it scans sendmail log entries to
determine who to tarpit. I would assume that it wouldn't be too
difficult to modify for any MTA that logs sufficient information about
rejected connections.

--
 John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
 jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  "Bother," said Pooh as he struggled with /etc/sendmail.cf, "it never
  does quite what I want. I wish Christopher Robin was here."
				           -- Peter da Silva in a.s.r
-----------------------------------------------------------------------
 26 days until Christmas