[cobalt-users] Re: SOLVED: Sendmail 8.9.3 and ORDB

[Peter Frederick <pfred@xxxxxxxxx>]

On Thu, 20 Mar 2003 15:03:49 -0500, you wrote:

>What is the best way to check the mail log and get a count?
>
>Bill

We run a cronjob every night that among other things analyses the prior
days maillog (/var/log/maillog.1).

I've chopped out a bit of the code that finds out the patterns that are put
in the file for the 3 current blocks we have implemented - first two are
obvious, the third Access denied comes from a blocked entry in your
/etc/mail/access database.

	:
	#
        # Now for Blocking stats we want to keep
        #
	LOG=/var/log/spamblock.log
	>$LOG
        for i in "Rejected - see http://relays.osirusoft.com/"; \
                "Spam blocked see: http://spamcop.net"; \
                "reject=550 5.7.1 Access denied"
        do
                grep "$i" /var/log/maillog.1 >>$LOG
                echo -n "BLOCKED: ${i}," 
                grep -c "$i" /var/log/maillog.1
        done

Make sure that the patterns match unique substrings that appear in your
maillog file.

Change /var/log/maillog.1 to /var/log/maillog if you want to watch what is
currently happening.

      
>
>>It'll take some CPU process from your system to compares w/the list,
>>there's no agreement or such.  Since this afternoon, my mail log logged
>>23442 spams denied from njabl, 6893 spams denied from spamcop, 6084 spams
>>denied from osirusoft.  DNSBL might not be 100% perfect, but close enough.
>>
>> > >sendmail.cf
>> > ># manually modified 3/19/03
>> > >
>> > ># DNS based IP address spam list relays.osirusoft.com
>> > >R$*                     $: $&{client_addr}
>> > >R::ffff:$-.$-.$-.$-     $: <?> $(host 
>> $4.$3.$2.$1.relays.osirusoft.com. $:
>> > >OK $)
>> > >R$-.$-.$-.$-            $: <?> $(host 
>> $4.$3.$2.$1.relays.osirusoft.com. $:
>> > >OK $)
>> > >R<?>OK                  $: OKSOFAR
>> > >R<?>$+                  $#error $@ 5.7.1 $: Rejected - see
>> > >http://relays.osirusoft.com/
>> > >
>> > ># DNS based IP address spam list bl.spamcop.net
>> > >R$*                     $: $&{client_addr}
>> > >R::ffff:$-.$-.$-.$-     $: <?> $(host $4.$3.$2.$1.bl.spamcop.net. $: OK $)
>> > >R$-.$-.$-.$-            $: <?> $(host $4.$3.$2.$1.bl.spamcop.net. $: OK $)
>> > >R<?>OK                  $: OKSOFAR
>> > >R<?>$+                  $#error $@ 5.7.1 $: "Spam blocked see
>> > >http://spamcop.net/bl.shtml?"$&{client_addr}
>> > >
>> > >
>> > ># DNS based IP address spam list relays.ordb.org
>> > >R$*                     $: $&{client_addr}
>> > >R::ffff:$-.$-.$-.$-     $: <?> $(host $4.$3.$2.$1.relays.ordb.org. $: 
>> OK $)
>> > >R$-.$-.$-.$-            $: <?> $(host $4.$3.$2.$1.relays.ordb.org. $: 
>> OK $)
>> > >R<?>OK                  $: OKSOFAR
>> > >R<?>$+                  $#error $@ 5.7.1 $: Spam blocked see www.ordb.org
>> > >
>> > >
>> > >- Mike
>> > >
>> > >
>> > >---------- original message ----------
>> > >
>> > >I'm running sendmail 8.9.3 (not my preference) and am attempting to 
>> install
>> > >ORDB onto sendmail to prevent accepting mails from open relay mail server.
>> > >
>> > >Below is the instructions for sendmail 8.9
>> > >
>
>_____________________________________
>cobalt-users mailing list
>cobalt-users@xxxxxxxxxxxxxxx
>To subscribe/unsubscribe, or to SEARCH THE ARCHIVES, go to:
>http://list.cobalt.com/mailman/listinfo/cobalt-users

-- 
Peter Frederick
MIS Director, Indiana Packers Corp, Delphi IN
Phone: (765) 564-9705   Fax: (765) 564-3684
Work: pfred@xxxxxxxxx
Home: pjfred@xxxxxxxxxxxxx
============================================================================
'Tis better to light one candle than to curse the darkness a thousand times!