From: "Dan Mahoney, System Admin" <[EMAIL PROTECTED]>
Sent: Monday, 2007, October 08 10:33
On Mon, 8 Oct 2007, Matus UHLAR - fantomas wrote:
On Sat, 6 Oct 2007, Rob McEwen wrote:
FWIW... that IP, 220.226.197.15, is currently listed on four spam
blacklists ("RBLs"):
1) uceprotect
2) no-more-funn
3) psbl
4) ivmSIP.com (mine)
On 07.10.07 05:55, Dan Mahoney, System Admin wrote:
My problem is: blocklists come and go, and some blocklists, when they
"go", do things like "hang up because they're being flooded, thus
slowing
my mail processes" or "flag all mail as spam" or "hand out stale data
that
hasn't changed at all in months/years".
That's what sa-update is for.
Personally, I'd like it if SA came with a blocklist-feeder tool, where
upon, say, two auto-learns, a blocklist (or SQL database) could be fed.
Why do you think people would use them, when they don't already use
sa-update which does the same?
sa-update does NOT feed a local blocklist generated by *my* particular
corpus of spam emails. Think of it as the RBL equivalent of
sitewide-bayes. Or think of it as a way of SA saying "when I get twelve
spams of score 10+ from ip 208.23.118.172...I will feed the auto-expiring
RBL, which *SENDMAIL* works off of, thus keeping my *SPAMASSASSIN* load
lower. Thus a spam deluge via a dictionary attack that may take hours is
mitigated in the course of X number of mails.
Which is what I was (off-topicly) asking for,
With procmail you can run any program you want based on features of
messages received. (Now, I'd not run say "startx" from procmail. But I
do use it to detect email from certain people and play a specific tune
for them using "play".) You could develop a little script for performing
that job.
{^_^}
