Re: spamd greylisting and server pools

[Camiel Dobbelaar]

On Tue, 21 Jun 2005, Heinrich Rebehn wrote:
> If a mail is sent via a server pool, it can take quite long until it happens
> to be sent 3 times from the same ip address and thus get whitelisted and
> delivered. With a big server pool this can take hours.

I use the attached very simple script to help spamd a little.  Also 
available at http://www.sentia.org/downloads/greyhelp.pl

This is just a work-around ofcourse, there were also patches to spamd to 
whitelist entire /24's at a time on tech@ if I recall correctly.

--
Cam


#!/usr/bin/perl -w
#
# greyhelp scans the grey entries in the spamd database.  If a
# sender/recipient tuple is tried from 3 (configurable) or more IP addresses
# in the same /24 network, then all the IP addresses are whitelisted.  This
# helps receiving mail from providers with big SMTP server farms.
# 
# Schedule this script in the _spamd crontab, every 15 mins.
#

use strict;

my $SPAMDB = "/usr/sbin/spamdb";
my $THRESH = shift || 3;

my %H;

open(FH, "$SPAMDB |") or die "cannot run spamdb: $!\n";
while (<FH>) {
        next unless m/^GREY/o;
        my (undef, $ip, $from, $to) = split /:/;

        # The sender/recipient tuple.
        my $tuple = "$from - $to";

        # /24 of the IP address.
        my $net24 = $ip;
        $net24 =~ s/\.\d+$//;

        $H{$tuple}{$net24}{$ip}++;
}
close(FH);

foreach my $tuple (keys %H) {
        foreach my $net24 (keys %{$H{$tuple}}) {
                if (scalar keys %{$H{$tuple}{$net24}} >= $THRESH) {
                        # print "$tuple -- $net24/24\n";
                        foreach my $ip (keys %{$H{$tuple}{$net24}}) {
                                # print "\t$ip\n";
                                print `spamdb -a $ip`;
                        }
                }
        }
}