I did know the web administration log, but I was in fact looking at the WEB CALENDARING web administration log. No wonder I didn't see login failures for the affected accounts. I had missed the extra "1" in the filename-- it'd be nice if Ipswitch made the naming convention a little more intuitive, wouldn't it?
Programmers should not be allowed to decide any names that are exposed to the Real World (gui labels, file names, help text, etc) and they need to be monitored closely or they will always commit such insanities. I've suffered so much from this kind of idiocy that all my file names in IMGate are rigorously self-explanatory/self-documenting.
1. eg, the shell script that harvests IPs of abusive senders from the maillog file rejected repeatedly for sending to unknown users (aka dict_ionary attacks)is called:
mta_clients_dict.sh
2. The database file that the above script updates and is used by postfix is
mta_clients_dict.map
3. mta_clients ... well, I hope everybody can figger that one out. (hint: the IMGate MX is the mta_server).
4. the mta_clients_dict file use this custom reject text
a.b.c 554 ACL mta_clients_dict
... where a.b.c is the Class C to be blocked.
4. The manually edited mta_clients black- and while-list files are called/get the generic, shortest name:
mta_clients_b.map mta_clients_w.map
In the _b file, the default/recommended custom reject text for blocking the IP ip.ad.re.ss or its PTR hostname is echoed from the file name:
ip.ad.re.ss 554 ACL mta_clients_b
label.domain.tld 554 ACL mta_clients_b
... so the IMate admin knows which filter file held the record that rejected the mta_client.
Want to whitelist one of your recipients (RCPT TO: envelope recipient) who is a spam lover? check out:
to_recipients_w.map where you put:
[EMAIL PROTECTED] ok
Want to blacklist a spammer's sender domain? Use from_senders_b.map (MAIL FROM: envelope sender):
domain.tld 554 ACL from_senders_b
(aka "RHS", right hand side (of what?) which itself is yet another stupid, confusing programmers acronym. ESD "envelope sender domain" is better, descriptive phase/acronym)
It's so easy to define these helpful conventions, and it's boring to setup IMGate (once you know the SMTP and DNS and the IMGate conventions) and easier to use.
Len
_____________________________________________________________________ http://IMGate.MEIway.com : free anti-spam gateway, runs on 1000's of sites
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
