Marc wrote:
> Here's my ACL
>
> defer senders = /var/spool/spam/suspicious-from.txt
> message = FROM Address temporarilly BLOCKED - Failed Recipient!
> !condition = ${if
> match_domain{$sender_address}{+all_mail_handled_locally}{true}{false}}
>
> warn message = Recipient Failure
> domains = +all_mail_handled_locally
> !verify = recipient/callout=2m,defer_ok,use_sender
> !hosts = +relay_from_hosts
> !senders = : postmaster@*
> condition = ${run{/etc/exim/scripts/log-file
> /var/spool/spam/suspicious-from.txt $sender_address}{yes}{yes}}
>
> And - then you add a 5 minute cron job to empty the list every 5 minutes.
>
> true > /var/spool/spam/suspicious-from.txt
You could quite easily eliminate the need for a 5 minute cron job to clear
your list. Send a timestamp along with the sender address. Store your list
like:
user@???: <timestamp>
Modify your lookup to retrieve the timestamp, then compare to the current
timestamp. If it's older than your 5 minute timeout, don't defer. In your
"don't defer" part, which really means returning a "no", instead embed
another ${run...} and call a script to purge your list of that address
(which would return a "no" as success/failure).
You'd have to watch out for file locks however - too much email and you can
run in to a process trying to add and another trying to remove. If you did
it with db files it might be a bit better for speed if you ended up with
lots of entries, and (guessing here) the db driver may help you handle locks
easier by imposing a wait rather than a deny if you tried to open another
lock when one's already open. It would also mean you don't have to worry
about detecting duplicates, since [Berkeley db] doesn't allow for duplicate
keys.
A daily cron script could still be beneficial though - as a maintenance
script. It could just ensure that all old entries are purged in case of
failures to purge at runtime. However, since you do compare the timestamp
of entries, even if one wasn't purged it wouldn't cause any problems.
Not relying on the cron job is good because if for whatever reason it fails
to run, your 5 minute block turns indefinite.
Eli.
