Byteplant Forum

Home » CleanMail Support » CleanMail SpamAssassin Filter » Filter by specific IP
Filter by specific IP [message #680] Tue, 18 May 2004 15:32
tjones
Messages: 1
Registered: May 2004
Junior Member
With the current rash of viruses blasting around, I find that it would be extremely useful to be able to at least temporarily, block mail by IP by entering it into the blacklist section. Is it possible to do that now?

When I look at the header of a viral email, I can see the originating IP. Using that IP would slow the same repeated virus attacks considerable. If at a later date, they resolve their virus issues and they have a legitimate reason for sending us email. then I would obviously want to be able to easily take them off of the blocked list.
Re: Filter by specific IP [message #681 is a reply to message #680] Tue, 18 May 2004 16:03 Go to previous message
support
Messages: 919
Registered: April 2004
Senior Member
> With the current rash of viruses blasting around, I find that
> it would be extremely useful to be able to at least
> temporarily, block mail by IP by entering it into the blacklist
> section. Is it possible to do that now?
>
> When I look at the header of a viral email, I can see the
> originating IP. Using that IP would slow the same repeated
> virus attacks considerable. If at a later date, they resolve
> their virus issues and they have a legitimate reason for
> sending us email. then I would obviously want to be able to
> easily take them off of the blocked list.

The offending IP will probably appear in one of the "Received:" headers. A header rule should get rid of this mail (add this to local.cf in the sa\ruleset subdirectory of your installation with a text editor):

header KNOWN_SPAM_IP Received =~ 12.34.56.78
describe KNOWN_SPAM_IP I have every reason to believe this is spam
score KNOWN_SPAM_IP 5.0

However, this sort of thing is exactly what RBL lists are for, and you will have a lot of work if you want to maintain your own blacklist this way. Look here for more on the topic of custom rules:

http://www.exit0.us/index.php
http://wiki.apache.org/spamassassin



Customer Support
Byteplant GmbH
Previous Topic: Is the learner working?
Next Topic: Bayes DB lost during upgrade?
Goto Forum:
  


Current Time: Mon Dec 05 21:35:01 CET 2016