Re: Mail errors or attacks?

[deloptes <deloptes@yahoo.com>]

David Baron wrote:

>> 
>> It it is always the same IP, add it to the backlist
> 
> How do I do this obvious task? In exim? I have fail2ban as well but this
> is not catching this one.

IF you are heavy user implement amavis-new (We've been using this in our
company since 2002 with great success - we have kaspersky commercial, 
spamassessing and clamav configured in amavis and we are training
spamassessing once a month - it's just great - paranoid linux users use
bogofilter - with bayesian prob.)

answer to your question:

man exim4-config_files

/etc/exim4/local_host_blacklist
       is an optional file containing a list of IP addresses, networks and
host names whose messages will be denied with  the  error 
message  "locally
       blacklisted".  This  is  a full exim 4 host list, and all available
features can be used. This includes negative items, and so it is possible
to
       exclude addresses from being blacklisted. For convenience, as an
additional method to  whitelist  addresses  from  being  blocked,  an 
explicit
       whitelist is read in from /etc/exim4/local_host_whitelist. Entries in
the whitelist override corresponding blacklist entries.

regards