Re: grokking exim4 and slowing spammers with iptables -m recent

[Tony Godshall <togo@of.net>]

...
> > So my question is...  Can you tell me or point me toward where I
> > would put my "echo to the penalty box" in the Exim4 configs?
> > 
> > Best Regards,
> > 
> > Tony
> 
> Just a guess:  Use fail2ban, point it to exim4/mainlog, set
> /etc/fail2ban.conf to trigger 'Unrouteable' to ban the offending IP
> (uses iptables).

Thanks for the idea.  Actually, though, I'd like to do it
immediately, not when it hits the logfile, since the delay
is enough to let a few messages through before penalty kicks
in.  But it would certainly save me from restarting my
little scripty bit when logrotate kicks in.  These are two
I'm experimenting with now: Any comments welcome.  

Penalty box (short timeout) for bad dest addresses:

  #reject for 40 seconds each time we get a smtp_penalty_box hit
  iptables -A INPUT \
    -m recent --name smtp_penalty_box --rcheck --seconds 40 \
    -j REJECT

  #put ip addrs into smtp_penalty_box list when we get a bad addr
  tail -f /var/log/exim4/mainlog\
  |perl -e '
  use strict;
  use POSIX qw(strftime);
  while (<>)
  {
    if(m{\[([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)\].*Unrouteable address})
    {
      open(OUTPUT, ">/proc/net/ipt_recent/smtp_penalty_box");
      print OUTPUT "$1\n";
      close(OUTPUT);
      my $disptime=strftime("%m-%d %H:%M:%S",localtime time);
      print "$disptime: penalty $1\n";
    }
  }'

Blacklist any ip who is coming in in parallel multiple identities...

  # block any IP on this list till it's quiet for five minutes
  iptables -A INPUT \
    -m recent --name smtp_multiple_idents --update --seconds 600 \
    -j DROP

  # detect IPs that are claiming to be multiple domains and
  # put them in the smtp_multiple_idents list
  while /bin/true
  do 
    exiwhat \
    |tee ~/exiwhat.out && \
    for ip in $( \
      cat ~/exiwhat.out\
      | tee ~/exiwhat.out\
      | perl -e '
        use strict;
        while(<>)
        {
          if(m{\(([^()]+)\) \[([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)\]})
          {
            print "$2 $1\n"
          }
        }' \
      | sort | uniq | cut -d' ' -f1 | uniq -c \
      | perl -ne 'if(m{^[ \t]+([0-9]+)[ \t]+([^ \t].*)}&&$1>1){print "$2\n"}'
    )
    do 
      echo $ip > /proc/net/ipt_recent/smtp_multiple_idents
      echo "multiple identities- $ip"
    done
    date
    sleep 15
  done

Best regards,

Tony