Hi, what I did was change the logging output in qmail-ldap (which is very easy) so the IP is always logged in /var/log/qmail-smtpd/..., together with the amount of mail sent (number of recipients in one session) I also run a script that always takes the last 5 minutes and counts the number of mails a specific IP sent, and if it is too much, I block it for half an hour. It's very easy to keep spammers under control that way, because just tarpitting them leaves an open connection and burdens the server. I think you need something like this (IP logging) together with number of mails and size or so, no?
(My changes are to 20010301, but I plan to port them to the latest release, and if anybody is interested, I can publish them.) Franky On Sun, 30 Sep 2001 18:51:22 +0200 Clemens Hermann <[EMAIL PROTECTED]> wrote: > Hi, > > I have not yet setup qmail-ldap and I found nothing in the docs so > hopefully someone here can give me a hint. > > It seems rather complicated to get a log-evaluation from stock-qmail > that tells me which virtual domain "consumed" how much traffic in a > given time-range. > > Things get even worse If I use smtp-after-pop/smtp-auth because I can > not just evaluate header fields (from: to:) but have to comapre the > sender-IP with the allowed IP-database from smtp-auth/smtp-after-pop. > > Are there any improvements in qmail-ldap compared to stock qmail so > that one can easily plug each message that passed the server to a > virtual domain and then get a monthly traffic report? > > Maex provided some good explanations on the qmail list. > Are things easier with qmail-ldap especially when > smtp-auth/smtp-after-pop comes into play? > > If not, how are you solving the issue? Perhaps anyone willing to offer > example scripts? > > thanks in advance for any help > > /ch > > -- > "Contrary to popular belief, Unix is user friendly. > It just happens to be selective about who it makes friends with." >
