FH3095/ScanMailLogAsns
1
0
Fork 0
Code Issues Pull requests Releases Activity
No description
123 commits 1 branch 0 tags 280 KiB
  • Python 84.3%
  • Shell 15.7%
Find a file
Exact
FH3095 a99b6e0430 Regular update 2026-03-07
2026-03-07 03:24:05 +01:00
.gitignore Update gitignore 2024-03-26 10:09:28 +01:00
blockAsn.py Adopt to new asn-ip format 2026-01-10 04:56:55 +01:00
blockedAsns.cidr.example Regular update 2026-03-07 2026-03-07 03:24:05 +01:00
blockedAsns.json.example Regular update 2024-03-26 2024-03-26 10:48:05 +01:00
convertAsn.py Adopt to new asn-ip format 2026-01-10 04:56:55 +01:00
LICENSE Initial commit 2023-12-01 20:12:53 +01:00
README.md Create README.md 2024-03-26 11:02:58 +01:00
scanMailLog.py Executable flag 2023-12-02 01:04:48 +01:00
updateAll.sh Update updateAll.sh 2024-03-11 08:12:44 +01:00
updateAllAndPush.sh Go back to old dir in updateAllAndPush 2024-03-26 11:05:54 +01:00

README.md

What is this for?

This is my personal block-file for postfix to block auth-attempts from some ASNs because I observed these ASNs in many auth-tries with different IP addresses. I use this in my postfix-conf: smtpd_discard_ehlo_keyword_address_maps = cidr:/etc/postfix/blockedAsns.cidr The mapping from ASN to IP-Blocks is provided by https://github.com/ipverse/asn-ip

How to use it

There are two ways to use it: Either create your own blockedAsns.json, enter ASNs there and run updateAll.sh. You should run updateAll.sh regularly in order to update the IP-Addresses for the blocked ASNs. Or you regularly pull from this repository and copy the blockedAsns.cidr.example to /etc/postfix. I keep this file up-to-date with my personal blockedAsns.cidr.