[Pkg-exim4-users] to simply block an email address

[Ross Boylan]

On Tue, 2007-07-17 at 11:22 -0700, Jeroen van Aart wrote:
> Hello,
> 
> I was wondering if there is a (debian specific) way to quickly and in a 
> simple manner block a specific email address for a little while (as 
> early as possible, not using procmail). Say you notice in the logs there 
> is a bunch of crap coming from someone, or some harddisk array or sql 
> server spams you with errors every 4 seconds, yet you can't go out and 
> reconfigure that machine just yet. I tried to find this out, but the 
> solutions I found seemed to be rather "big" for the intended purpose.
> 
> Thank you,
> Jeroen
> 
It's not debian-specific, but the whole ACL framework in exim4 is
designed for this.

If you want to block everything from a machine, you can drop the
connection as soon as it says HELO (smtp).

If you want to block a particular sender, if it's the envelope sender
(i.e., smtp return address), you can block it when that comes in.

Finally, if you need to look at the headers of the message, you can act
after the message body comes in, but still before it goes to any
routers.
-- 
Ross Boylan                                      wk:  (415) 514-8146
185 Berry St #5700                               ross at biostat.ucsf.edu
Dept of Epidemiology and Biostatistics           fax: (415) 514-8150
University of California, San Francisco
San Francisco, CA 94107-1739                     hm:  (415) 550-1062