My thoughts exactly. I was actually also thinking of getting the script to add the rule to our satellite receivers and border router as well, but I'll settle for ipchains on the server for now.
My plan was just a quick script to analyse the logs and block certain IP's, then have a cron job flush and rebuild the ipchains/iptables rules every morning. It is more of a nusiance that a major bandwidth/server resources drain, and I have many other things on my todo list that are more important ATM. I anyone wants to write a more featured program and package it I'm sure a few people including me would be grateful. Andrew Tait System Administrator Country NetLink Pty, Ltd E-Mail: [EMAIL PROTECTED] WWW: http://www.cnl.com.au 30 Bank St Cobram, VIC 3644, Australia Ph: +61 (03) 58 711 000 Fax: +61 (03) 58 711 874 "It's the smell! If there is such a thing." Agent Smith - The Matrix ----- Original Message ----- From: "Russell Coker" <[EMAIL PROTECTED]> To: "Andrew Tait" <[EMAIL PROTECTED]>; "Nathan Ridge" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Monday, March 04, 2002 9:29 PM Subject: Re: Spammers hammering our mail servers > One advantage of basing such a system on parsing log files is that it would > be possible to write a script that uses log files from different programs. > Then we could spend more time on getting this done properly, have specified > timeouts for blocked IP addresses, have the cache of IP addresses be > maintained across boots, etc. > > I would be happy to add something like this to my logtools package if there > are code contributions... > > -- > If you send email to me or to a mailing list that I use which has >4 lines > of legalistic junk at the end then you are specifically authorizing me to do > whatever I wish with the message and all other messages from your domain, by > posting the message you agree that your long legalistic sig is void. > > > -- > To UNSUBSCRIBE, email to [EMAIL PROTECTED] > with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] > > -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
