Re: Modifications for exim filter
Nigel Metheringham <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
Here is my set of exim filter modifications, which handles:- - minor differences in sender/recipient verify formatting - now handles unqualified recipient addresses - some DNSBL warning handling (this is the most config dep bit) - handling of obscure forged address messages - handling of transaction/protocol/synchronisation errors and drops - handling of too many connections messages I've been running this for around 3 weeks now (although tweaking it slightly during that time). Its now handling everything I get in the log on a normal day.... Nigel. -- [ Nigel Metheringham [email protected] ] [ - Comments in this message are my own and not ITO opinion/policy - ] _______________________________________________ Logwatch-Devel mailing list [email protected] http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel
logwatch-exim.patch
(application/octet-stream, 5.5 KB)
Index: scripts/services/exim
===================================================================
RCS file: /var/cvs/logwatch/scripts/services/exim,v
retrieving revision 1.19
diff -u -r1.19 exim
--- scripts/services/exim 23 Aug 2006 21:19:02 -0000 1.19
+++ scripts/services/exim 6 Feb 2007 12:28:09 -0000
@@ -107,16 +107,16 @@
elsif ( $ThisLine =~ /cwd=.*? \d args: / ) {
# ignore this; it is exim (or an Exim sub-command) starting.
}
- elsif ( $ThisLine =~ /recipient verify fail/ ) {
+ elsif ( $ThisLine =~ /[Rr]ecipient verify fail/ ) {
$RecipVerify{$ThisLine}++;
}
- elsif ( $ThisLine =~ /sender verify fail/ ) {
+ elsif ( $ThisLine =~ /[Ss]ender verify fail/ ) {
$SendVerify{$ThisLine}++;
}
elsif ( $ThisLine =~ /fragments administratively prohib/ ) {
$DontAccept{$ThisLine}++;
}
- elsif ( $ThisLine =~ /unqualified sender rejected/ ) {
+ elsif ( $ThisLine =~ /unqualified (sender|recipient) rejected/ ) {
$DontAccept{$ThisLine}++;
}
elsif ( $ThisLine =~ /do not accept mail / ) {
@@ -125,6 +125,9 @@
elsif ( $ThisLine =~ /believed to be spam/ ) {
$DontAccept{$ThisLine}++;
}
+ elsif ( $ThisLine =~ /[Ww]arning: dnsbl\.sorbs\.net/ ) {
+ $DontAccept{$ThisLine}++;
+ }
elsif ( $ThisLine =~ /mail not permitted from/ ) {
$DontAccept{$ThisLine}++;
}
@@ -134,6 +137,9 @@
elsif ( $ThisLine =~ /not accept Windows executables/ ) {
$DontAccept{$ThisLine}++;
}
+ elsif ( $ThisLine =~ /remote host address is the local host/ ) {
+ $DontAccept{$ThisLine}++;
+ }
elsif ( $ThisLine =~ /message contains malware/ ) {
# Exim <= 4.44 with ExiScan-ACL Patch (Running AntiVirus Software)
$Virus{$ThisLine}++;
@@ -174,6 +180,31 @@
# Common error from SPAM hosts.
$Proto{$ThisLine}++;
}
+ elsif ( $ThisLine =~ /incomplete transaction \(([\s\w]+)\) from/ ) {
+ # Common error from SPAM hosts (after recipient reject/callout).
+ $Proto{$ThisLine}++;
+ }
+ elsif ( $ThisLine =~ /SMTP protocol synchronization error \(([\s\w:]+)\):/ ) {
+ # Spammer who does not wait before sending crap
+ $Proto{$ThisLine}++;
+ }
+ elsif ( $ThisLine =~ /dropped: too many nonmail commands/ ) {
+ # Often someone who tries lots of transactions
+ $Proto{$ThisLine}++;
+ }
+ elsif ( $ThisLine =~ /dropped: too many syntax or protocol errors/ ) {
+ # Often someone who tries lots of transactions
+ $Proto{$ThisLine}++;
+ }
+ elsif ( $ThisLine =~ /SMTP protocol error in \"\w+\"/ ) {
+ # Some hosts ask for TLS even when not offered (generalised to all cmds)
+ $Proto{$ThisLine}++;
+ }
+ elsif ( $ThisLine =~ /Connection from .* too many connections from that IP address/ ) {
+ # Some hosts make lots of simultaneous connections
+ # this is an extra error message when logging is high
+ # and since another message duplicates it, we can just ignore this
+ }
elsif ( $ThisLine =~ /rejected [HE][EH]LO from\s/ ) {
# Typically due to underscores _ in the HELO line
# (a common protocol violation)
@@ -379,6 +410,10 @@
$cc = "Blocked Fragmented Message";
( $bb ) = ($ThisOne =~ m/\[(\d+\.\d+\.\d+\.\d+)\]/);
}
+ elsif ( $ThisOne =~ /[Ww]arning: dnsbl\.sorbs\.net/ ) {
+ $cc = "Blocked by DNSBL (SORBS)";
+ ( $bb ) = ($ThisOne =~ m/\[(\d+\.\d+\.\d+\.\d+)\]/);
+ }
elsif ( $ThisOne =~ /fragments administratively prohibited/ ) {
$cc = "Blocked Fragmented Message";
( $bb ) = ($ThisOne =~ m/\[(\d+\.\d+\.\d+\.\d+)\]/);
@@ -387,10 +422,18 @@
$cc = "Unqualified Sender";
$bb = "$1";
}
+ elsif ( $ThisOne =~ m/unqualified recipient rejected: <(.*)>/ ) {
+ $cc = "Unqualified Receipient";
+ $bb = "$1";
+ }
elsif ( $ThisOne =~ m/not accept Windows executables/ ) {
$cc = "Blocked Attachment";
( $bb ) = ($ThisOne =~ m/\[(\d+\.\d+\.\d+\.\d+)\]/);
}
+ elsif ( $ThisOne =~ m/remote host address is the local host/ ) {
+ $cc = "Invalid local domain";
+ ( $bb ) = ($ThisOne =~ m/\@\[^>]+/);
+ }
else {
# If we picked up a malfunction but didn't collect it here,
# no need to make the user suffer with superfluous error
@@ -472,6 +515,26 @@
$cc = "IP address in HELO";
( $bb ) = ($ThisOne =~ m/\[(\d+\.\d+\.\d+\.\d+)\]/);
}
+ elsif ( $ThisOne =~ /incomplete transaction (\(.*\))/ ) {
+ $bb = "SMTP transaction cut short $1";
+ $SmtpConnection{$bb}++;
+ }
+ elsif ( $ThisOne =~ /SMTP protocol synchronization error/ ) {
+ $bb = "SMTP protocol synchronization error";
+ $SmtpConnection{$bb}++;
+ }
+ elsif ( $ThisOne =~ /dropped: too many nonmail commands/ ) {
+ $bb = "Connection dropped after too many nonmail SMTP commands";
+ $SmtpConnection{$bb}++;
+ }
+ elsif ( $ThisOne =~ /dropped: too many syntax or protocol errors/ ) {
+ $bb = "Connection dropped after too many syntax/protocol errors";
+ $SmtpConnection{$bb}++;
+ }
+ elsif ( $ThisOne =~ /(SMTP protocol error in \"\w+\")/ ) {
+ $bb = $1;
+ $SmtpConnection{$bb}++;
+ }
elsif ( $ThisOne =~ /SMTP connection from/ ) {
if ( $ThisOne =~ /lost while reading message data/ ) {
$bb = "SMTP connection lost while reading message data";