Dan Mahoney, System Admin wrote:
sa-update does NOT feed a local blocklist generated by *my* particular
corpus of spam emails. Think of it as the RBL equivalent of
sitewide-bayes. Or think of it as a way of SA saying "when I get twelve
spams of score 10+ from ip 208.23.118.172...I will feed the
auto-expiring RBL, which *SENDMAIL* works off of, thus keeping my
*SPAMASSASSIN* load lower.
How do you call SpamAssassin?
If whatever calls SpamAssassin in your setup knows what IP the
connecting relay has, it can hopefully also do what you describe
above. SpamAssassin doesn't really need to support this (through
plugins or anything else) for it to be possible (and feasible).
We do something similar (combined with a bunch of other data)
using MIMEDEfang, a *very* customizable sendmail milter.
Our filter checks the IP of each incoming connection against a
database, and rejects the connection if the relay has sent us a
too much spam in proportion to ham, or if it has more than a
certain amount of entries in a specific table (to wich entries
are added for unknown users, spam, and more).
You can try to find more info about our setup by reading the code
at: <http://whatever.frukt.org/mimedefangfilter.text.shtml>
Our filter works with a SQL database, but it should be perfectly
possible to use similar methods to feed a local DNSBL (or write a
DNS server that uses the database as a data source) in order to
be able to use allready existing code for the lookups.
Regards
/Jonas
--
Jonas Eckerman, FSDB & Fruktträdet
http://whatever.frukt.org/
http://www.fsdb.org/
http://www.frukt.org/
