client_addr in virtusertable error message

client_addr in virtusertable error message

am 03.10.2007 18:07:54 von Joseph Brennan

I wish I could do something like this in virtusertable:

jra54449@cs.columbia.edu error:5.7.0:550 User unknown
$&{client_addr}

I could edit virtusertable.m4 to do it as below (this works). I'd
rather avoid editing a standard file though, for future
maintainability. Is there a way to get it into virtusertable?

R< error : $-.$-.$- : $+ > $* $#error $@ $1.$2.$3 $: $4
$&{client_addr}


The reason might be of interest. We (columbia.edu) host
cs.columbia.edu using virtusertable. A spammer is sending a huge
volume of mail with the sender address shown, to a very bad (or very
large?) recipient list. We are getting 1.4 million bounces a day to
this address, which does not and never did exist. We'd like to
identify the hosts hammering us with this stuff without having to
match the "User unknown" syslog line to the "from=" syslog line--
given the numbers involved.

Joseph Brennan
Columbia University IT

Re: client_addr in virtusertable error message

am 04.10.2007 00:48:50 von per

In article <1191427674.292749.48590@57g2000hsv.googlegroups.com> Joe
Brennan writes:
>
>I wish I could do something like this in virtusertable:
>
>jra54449@cs.columbia.edu error:5.7.0:550 User unknown
>$&{client_addr}
>
>I could edit virtusertable.m4 to do it as below (this works). I'd
>rather avoid editing a standard file though, for future
>maintainability. Is there a way to get it into virtusertable?
>
>R< error : $-.$-.$- : $+ > $* $#error $@ $1.$2.$3 $: $4
>$&{client_addr}

No, but it's trivial to add as a custom rule in your .mc file (i.e. not
using virtusertable at all):

LOCAL_RULE_0
R jra54449<@cs.columbia.edu.> $#error $@ 5.7.0 $: "550 User unknown " $&{client_addr}

--Per Hedeland
per@hedeland.org

client_addr in virtusertable error message

am 04.10.2007 17:02:08 von Joseph Brennan

> No, but it's trivial to add as a custom rule in your .mc file (i.e. not
> using virtusertable at all):

But that's too simple :-) Thanks