client_addr in virtusertable error message
am 03.10.2007 18:07:54 von Joseph BrennanI wish I could do something like this in virtusertable:
jra54449@cs.columbia.edu error:5.7.0:550 User unknown
$&{client_addr}
I could edit virtusertable.m4 to do it as below (this works). I'd
rather avoid editing a standard file though, for future
maintainability. Is there a way to get it into virtusertable?
R< error : $-.$-.$- : $+ > $* $#error $@ $1.$2.$3 $: $4
$&{client_addr}
The reason might be of interest. We (columbia.edu) host
cs.columbia.edu using virtusertable. A spammer is sending a huge
volume of mail with the sender address shown, to a very bad (or very
large?) recipient list. We are getting 1.4 million bounces a day to
this address, which does not and never did exist. We'd like to
identify the hosts hammering us with this stuff without having to
match the "User unknown" syslog line to the "from=" syslog line--
given the numbers involved.
Joseph Brennan
Columbia University IT