#!/bin/bash
BLOCK_IP='/tmp/smtp_block_list.txt'

if [ $(ipset --list | wc -l) -eq 0 ]
then
    ipset -N block_smtp iphash
    iptables -I RH-Firewall-1-INPUT -p tcp --match multiport --dport 25,587 -m set --match-set block_smtp src -j DROP
fi

cat /var/log/maillog* | grep ""did not"" | grep -v '115.68.233.16' | awk -F[\[] '{ print $3 }' | awk -F[\]] '{ print $1 }' | sort -u | tr -d ' ' > ${BLOCK_IP}

for IPSET_ADD in $( cat ${BLOCK_IP} )
do
    ipset -! add block_smtp ${IPSET_ADD}
done

[xxx.xxx.xxx.xxx] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA 로그 발생시키는 ip 차단하는 스크립트

smtp 모니터링 서버인 115.68.233.16은 예외 처리 함.

ipset을 iptables에서 사용할 수 있어야 함.

iptables 체인에 맞게 수정해서 사용하면 됨.

-적용 일주일 후 ipset에 추가된 ip

[root@host-10-101-0-10 yeonghoon.kim]# ipset --list
Name: block_smtp
Type: hash:ip
Revision: 4
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 7128
References: 1
Number of entries: 160
Members:
159.203.201.190
159.203.201.60
185.36.81.246
185.36.81.252
159.203.201.131
111.75.149.221
159.203.201.29
125.74.69.229
45.82.153.135
198.143.158.82
193.188.22.220
78.128.113.121
92.118.38.55
159.203.201.179
221.4.146.171
45.79.25.214
159.203.193.245
103.253.42.48
83.97.20.49
45.125.65.80
71.6.199.23
59.39.177.195
198.108.66.161
185.36.81.232
159.203.201.125
104.152.52.23
106.52.236.249
183.238.53.242
45.125.65.34
219.135.139.244
106.38.91.195
159.203.201.242
18.223.203.37
159.203.201.12
193.106.29.130
103.253.42.39
223.71.167.62
51.91.212.79
45.82.153.134
138.68.212.139
211.104.168.218
34.221.154.203
45.125.65.58
185.142.236.34
109.64.71.76
159.203.201.154
113.69.207.43
185.156.177.52
159.203.201.81
117.50.6.160
123.31.26.113
185.234.219.81
219.135.139.242
172.105.4.227
103.253.42.34
159.203.201.138
159.203.201.194
178.73.203.17
198.108.66.32
3.133.147.51
71.6.232.5
61.7.231.24
185.234.218.210
60.2.99.126
115.85.213.217
185.36.81.242
45.125.65.82
45.10.90.29
139.162.99.243
208.100.26.233
121.33.247.107
219.150.116.52
219.135.139.245
45.82.153.76
185.36.81.248
212.83.146.233
45.82.153.133
198.108.66.112
185.36.81.231
45.82.153.77
125.45.11.247
178.73.215.171
91.134.145.129
218.77.104.37
198.108.66.80
101.89.109.136
111.231.85.239
45.141.84.18
141.98.10.62
185.36.81.251
198.108.66.224
89.248.169.12
84.201.160.82
198.108.66.208
208.100.26.231
223.71.167.154
112.45.122.8
103.254.153.113
198.143.155.138
111.225.0.208
159.203.201.227
5.254.150.37
211.150.70.18
222.161.221.230
46.38.144.202
89.248.168.112
101.89.216.223
159.203.201.45
159.203.201.32
61.107.72.165
60.190.226.188
58.57.4.238
185.227.6.42
185.36.81.243
185.36.81.16
141.98.10.61
60.19.64.10
195.154.61.206
18.237.175.136
159.203.193.244
159.203.201.122
193.188.22.216
185.36.81.245
93.116.235.14
221.0.232.118
122.228.19.80
185.36.81.250
61.142.247.210
80.82.70.118
172.105.80.151
185.36.81.236
95.211.105.203
159.203.201.47
111.39.27.219
71.6.232.4
185.36.81.233
159.203.201.64
159.203.197.15
141.98.10.55
141.98.10.60
104.236.247.64
185.36.81.229
51.91.212.81
80.82.77.139
159.203.197.28
159.203.197.22
92.118.38.54
185.36.81.230
94.102.57.137
45.82.153.78
103.253.42.44
208.100.26.237
218.4.239.146
61.172.142.58
80.82.77.232
159.203.201.94
164.52.24.168
123.233.246.52
185.216.140.7
193.56.28.176