Hi all,
I'm using spamd and it does a great job.
What I'm trying to figure out is how to easily add the IP's of the
sending mail server for the few
spam that still get through.
By easy, I mean for clients of mine who use Exchange/, where I
put a obsd box running spamd
in front of Exchange.
I am trying to find a way where I could tell my clients that when some
spam does get through, just forward
that spam to a particular email address. Some process will extract the
IP of the MTA that sent the spam
and blacklist it.
I installed and played around with relaydb from ports, but that doesn't
work with emails that have been forwarded.
Any ideas?

5/20/06, Craig Hammond <Craig (AT) sbisolutions (DOT) com.auwrote:
Hi all,
I'm using spamd and it does a great job.

What I'm trying to figure out is how to easily add the IP's of the
sending mail server for the few
spam that still get through.

By easy, I mean for clients of mine who use Exchange/, where I
put a obsd box running spamd
in front of Exchange.

I am trying to find a way where I could tell my clients that when some
spam does get through, just forward
that spam to a particular email address. Some process will extract the
IP of the MTA that sent the spam
and blacklist it.

I installed and played around with relaydb from ports, but that doesn't
work with emails that have been forwarded.

Any ideas?
--

You do know that headers can be forged right? So an automagic forward
-|/script -blacklist from a pissed off user can end up
blacklisting a legitimate MTA.

You may want to just look into greylisting and using some aggressive
milters (milter_regex is my savior).

than that, just read aliases(5), forward(5) or look into procmail

* Craig Hammond <Craig (AT) sbisolutions (DOT) com.au[060520 07:19]:
Hi all,
I'm using spamd and it does a great job.

What I'm trying to figure out is how to easily add the IP's of the
sending mail server for the few
spam that still get through.

By easy, I mean for clients of mine who use Exchange/, where I
put a obsd box running spamd
in front of Exchange.

I am trying to find a way where I could tell my clients that when some
spam does get through, just forward
that spam to a particular email address. Some process will extract the
IP of the MTA that sent the spam
and blacklist it.

I installed and played around with relaydb from ports, but that doesn't
work with emails that have been forwarded.

Any ideas?

Take a look at mail/relaydb in the ports tree. Also check the archives
as this has been discussed at depth and included several solutions.

Jim

Hey I got exactly what you are looking for, its pretty easy. You need
relaydb and procmail.
Setup a user called 'spam' then in /home/spam/

# cat .forward
|/home/spam/procspam.sh

# cat .procmailrc
# .procmailrc
RGMAIL=/var/mail/$LGNAME
PATH=/usr/bin:/usr/local/bin
MAILDIR=$HME/.mailspool # all mailboxes are in .mailspool/
#DEFAULT=$HME/.mailspool/spam
LGFILE=/dev/null
SHELL=/bin/sh
:0b:
spam

# cat procspam.sh
#!/bin/sh
HME=/home/spam

/usr/local/bin/procmail
relaydb -f /var/spamd/.relaydb -i /var/spamd/whitelist.relaydb | cat
spam | grep -A 1000 Received: | relaydb -bf /var/spamd/.relaydb
rm $HME/spam

and then of course spamd.conf
relaydb-black:\
:black:\
:msg="SPAM. Your address %A is in my relaydb list.":\
:method=exec:\
:file=/usr/local/bin/relaydb -4lb -f /var/spamd/.relaydb:

Craig Hammond wrote:
Hi all,
I'm using spamd and it does a great job.

What I'm trying to figure out is how to easily add the IP's of the
sending mail server for the few
spam that still get through.

By easy, I mean for clients of mine who use Exchange/, where I
put a obsd box running spamd
in front of Exchange.

I am trying to find a way where I could tell my clients that when some
spam does get through, just forward
that spam to a particular email address. Some process will extract the
IP of the MTA that sent the spam
and blacklist it.

I installed and played around with relaydb from ports, but that doesn't
work with emails that have been forwarded.

Any ideas?

>You do know that headers can be forged right? So an automagic forward
|/script -blacklist from a pissed off user can end up
>blacklisting a legitimate MTA.

This is a good point, if you use the scripts I sent you may want to
modify them
to look for a password, should be simple enough.

Mike Spenard