I did the same thing here, for exactly the same reasons. Here are my notes about which filter function I ended up using:
# # If the current connection is using auth, determine if that user has # sent from too many different IPs recently. # # This has to be done in filter_sender because: # # * In filter_relay() (the obvious choice), no access to SendmailMacros # * filter_begin() is called too late(!) after the message is accepted # * filter_recipient() is potentially called multiple times # We've found that this approach works and is valuable, although it has been tricky to determine what a "safe" number of IPs is to allow. In particular, smartphones roaming around the city tend to look like they are connecting from many IPs. We eventually changed the comparrison to consider the number of /24 subnets the IPs were from, which helped. (I.e. 172.14.89.2, 172.14.89.12, and 172.14.89.119, all count as being from a single subnet). Of course it lowers the chance of catching someone who is exploiting a small server farm to send spam, but in practical use it seems to be working OK). Oh, and for webmail, we're applying the same logic to something that watches the webmail's logfiles. Thanks, Mark On Mon, May 05, 2014 at 01:07:42PM +0200, Benoit Panizzon wrote: > Well, after some more RTFM and stumbling over a thread about documentation > issues with global variables: > http://lists.roaringpenguin.com/pipermail/mimedefang/2010-May/035763.html > > I constate that $RelayAddr is available in filter_begin but > read_commands_file > is not. > > Benoit Panizzon > -- > I m p r o W a r e A G - > ______________________________________________________ > > Zurlindenstrasse 29 Tel +41 61 826 93 07 > CH-4133 Pratteln Fax +41 61 826 93 02 > Schweiz Web http://www.imp.ch > ______________________________________________________ > _______________________________________________ > NOTE: If there is a disclaimer or other legal boilerplate in the above > message, it is NULL AND VOID. You may ignore it. > > Visit http://www.mimedefang.org and http://www.roaringpenguin.com > MIMEDefang mailing list MIMEDefang@lists.roaringpenguin.com > http://lists.roaringpenguin.com/mailman/listinfo/mimedefang -- Mark Costlow | Southwest Cyberport | Fax: +1-505-232-7975 che...@swcp.com | Web: www.swcp.com | Voice: +1-505-232-7992 Mail Minder - Intelligent Push Notifications for Email on the iPhone http://mailminderapp.com/download or in the App Store _______________________________________________ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit http://www.mimedefang.org and http://www.roaringpenguin.com MIMEDefang mailing list MIMEDefang@lists.roaringpenguin.com http://lists.roaringpenguin.com/mailman/listinfo/mimedefang