Shell question

[Warren Block]

On Wed, 25 Oct 2006, Jack Stone wrote:

> Folks:
> I have managed to piece together a shell script that is able to retrieve the 
> domains from the spams of the day and summarize those in a special file that 
> can then be added to the sendmail's rejects in the access.db. But, first I 
> have to eyeball the list and remove any obvious good-guy domains.
>
> I would like to create another list of those same good guys that can be added 
> to each day as they show up, then compare it to the above main list and 
> delete the good guy domains before adding to the access.db.

Greylisting will be much more effective than this approach, and is 
easier to implement.  Combine that with sbl-xbl and maybe a few other 
DNSBLs, add greet_pause of five or ten seconds, and you have much more 
effectiveness with less false positives and much less maintenance. 
Adding clamav rounds out the whole thing.  I wrote an article that 
covers some of this:

http://www.wonkity.com/~wblock/greylist.pdf

-Warren Block * Rapid City, South Dakota USA