[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Notice: in file [ROOT]/includes/session.php on line 2208: Array to string conversion
[phpBB Debug] PHP Warning: in file [ROOT]/includes/functions.php on line 4688: Cannot modify header information - headers already sent by (output started at [ROOT]/includes/functions.php:3823)
[phpBB Debug] PHP Warning: in file [ROOT]/includes/functions.php on line 4690: Cannot modify header information - headers already sent by (output started at [ROOT]/includes/functions.php:3823)
[phpBB Debug] PHP Warning: in file [ROOT]/includes/functions.php on line 4691: Cannot modify header information - headers already sent by (output started at [ROOT]/includes/functions.php:3823)
[phpBB Debug] PHP Warning: in file [ROOT]/includes/functions.php on line 4692: Cannot modify header information - headers already sent by (output started at [ROOT]/includes/functions.php:3823)
Poco Forums • View topic - IP address filtering

IP address filtering

Scripting questions and ideas

Moderators: Eric, Tomas, robin, Michael

IP address filtering

Postby FieldDir121 » Tue Jun 07, 2005 5:57 pm

I have been using filters to automatically delete e-mails from specific IP addresses such as [24.56.188.67]. At this point I have a list of about 2500. Using filters is getting too bloated.

What I would like is two scripts. One that compares the incoming IP address between the brackets to the addresses in a file. If found, delete the message and attachments.

The second script would be used to add a new IP address to the list in the file. Ideally the script would insert the new address in numerical order.

There are some exceptions, but I could continue to handle these using filters. For instance, I delete all e-mails from specific blocks of addresses, [193., [200., etc.

I have found this to be better than the Bayesian filter which I still run after all the other filters. The problem with that is that I have to look through the junk mailbox to see if any real e-mails were considered spam. So far, using the system above I have not had a single instance of a false delete (that I know of).

Every once in a while instead of deleting the messages I put them in a special mail box. Typically between 50% and 80% of all incoming spam is identified and automatically deleted [when set to delete].

Scott
FieldDir121
Resident Poster
 
Posts: 149
Joined: Mon Aug 02, 2004 5:18 pm

Postby SFCurley » Wed Jun 08, 2005 3:37 am

Don't know if you know, but there is a poco script that will check incoming email by ip address aagainst any of several DNS blacklists. I use it as one of my standard filters. Here's the link to that forum post.

http://www.pocosystems.com/forum/viewtopic.php?t=482
SFCurley
 

Postby FieldDir121 » Wed Jun 08, 2005 10:49 am

SFCurley,

Having had problems with others (our mail server) pre-screening my incoming e-mail I would prefer to use only a local list over whcih I have complete control. I get unexpected e-mails from nearly anywhere regarding company products.

When I am seeking information from other companies and encounter one of those "you must register for me to get your e-mail" replies I go elsewhere so I expect others do also.

Scott
FieldDir121
Resident Poster
 
Posts: 149
Joined: Mon Aug 02, 2004 5:18 pm

Postby SFCurley » Wed Jun 08, 2005 11:14 am

I looked through the list of scripts available and did not see anything that really matched what you were looking for. Might be one you have to patch together yourself, if you're up for writing a script or two. A couple of scripts that might give you most of the code to cut and paste are:

ban_domain_and_move_to_trash.poc should give you the code to add selected entries to a file.

the script referenced in my first post has very robust ip address extraction code.

I have a script I wrote which takes a pre-defined field (ip address in your case) and searches through a file (like your banned ip address list) and from there you can take whatever action you want. I will post it here if you think it would be helpful.
SFCurley
 

Postby blakelyg » Wed Jun 08, 2005 11:31 pm

SFCurley wrote:I have a script I wrote which takes a pre-defined field (ip address in your case) and searches through a file (like your banned ip address list) and from there you can take whatever action you want. I will post it here if you think it would be helpful.


Please post it here. I might also like to take a look at it. :D
blakelyg
Resident Poster
 
Posts: 167
Joined: Sun Jul 25, 2004 10:13 pm
Location: Laval Quebec

Postby SFCurley » Thu Jun 09, 2005 1:56 am

Here it is. Hope it's helpful.

{ This script can be run on incoming or selected messages
{ and will read from a user-specified input "match" file.
{ If any of the lines in the input file are found to be
{ present in either the Subject or From field of the email
{ message, the message will then be moved to a user-specified
{ mailbox. Both the user-specified "match" file name and
{ the mailbox name can be changed in the Script Setup.
{ The match-file must be located in the main Poco
{ applicaiton directory.
{
{ This provides functionality similar to the %file% comparison
{ operation provided by PocoMail, but matches only one way --
{ i.e., the entire match line in the input file must be
{ present in the subject or the from fields for a match to be
{ found.
{
{ I use this script to sort all of my newsletters into a
{ Poco mailbox called "To Read".
{
{ You can have multiple versions of this script, with each
{ one's setup referencing a different match input file and
{ target mailbox. In this case, just copy and rename the
{ script in the Poco Script directory and change the Setup
{ Parameters accordingly for each different match/move.
{
{ Written 08-12-04 by Sean Curley
{

External $userdata1 "Match Text File Name" #file.txt
Set $ifilename $userdata1

External $userdata2 "Mailbox to Move Matches Into" mailbox
Set $mailbox $userdata2

{ Verify that the specified Poco Mailbox exists

Set $mailboxfile $mailpath
AddStrings $mailboxfile $mailbox
AddStrings $mailboxfile ".mbx"
FileExists &mailboxexists $mailboxfile

{ Verify that the specified Match input file exists

Set $mfilename $mailpath
AddStrings $mfilename $ifilename
FileExists &mfileexists $mfilename

{ If either mailbox or file are missing go to error routine

Set &Error1 &mailboxexists
Set &Error2 &mfileexists
Not &Error1
Not &Error2
Or &Error1 &Error2
If &Error1 then FileError

{ Get Subject and From fields; convert to lowercase

ReadHeader $subject "Subject:" %message
Lowercase $subject

ReadHeader $from "From:" %message
Lowercase $from

{ Read input match file, convert to lowercase, trim,
{ and check that not empty

Set $OnErrorGoTo "FileError"
OpenBody $matchfile $mfilename
LowerCase $matchfile
TrimLines $matchfile
LineCount #linecount $matchfile
If #linecount < 1 then FileError

Set #loopcount 1

:FileLoop

Set #linepos #loopcount
SubIntegers #linepos 1

{ Read input line, convert to lowercase

GetLine $currentline #linepos $matchfile
Lowercase $currentline

{ If match found, go to Match move routine

If $currentline ^ $subject then Match
If $currentline ^ $from then Match

If #loopcount = #linecount then End
Inc #loopcount

Goto FileLoop


{ Match routine savies msg to specified mailbox,
{ checks if successful, { and then deletes from
{ initial mailbox

:Match
Set $OnErrorGoTo "MoveFailed"
SaveMessage %message $mailbox
DeleteMessage %message
Goto End


:FileError
MessageBox "Empty or Missing Match File and/or Mailbox"
Goto End


:MoveFailed
MessageBox "Could Not Move Message"

:End

Exit
SFCurley
 

Postby Michael » Thu Jun 09, 2005 2:27 am

Just a quick note, you do not have to resort to a script to do this, you can use a file within a filter condition. See also my posting in this thread.
Michael
Moderator
 
Posts: 866
Joined: Mon Jul 26, 2004 12:14 pm
Location: Victoria BC, Canada

Postby SFCurley » Fri Jun 10, 2005 1:11 pm

As always, I am awed by the simplicity and elegance of another's approach. Thanks, Michael.
SFCurley
 

Postby FieldDir121 » Fri Jan 06, 2006 4:18 pm

Michael,

The file within a filter has been very helpful in eliminating spam using keywords.

I added a second file within a filter using ip addresses [123.456.789]. What I am seeing is that the ip addresses of the messages getting caught by the keyword file commonly get used again within the next few days. Many of these messages get past the keyword filters but get caught by the ip address filter. Spot checking shows that once an address gets old (a few weeks) it is rarely used again. This means the file doesn't need to have more than a couple thousand addresses.

Extracting the ip address manually is very tedious. I have been telling myself that I should learn how to write a script to do it but it has been a few months and it still hasn't happened. I was wondering if anyone has a script that I can modify that would take the ip address within brackets from the "received:" line of the header and add it to a file. Adding the new address to the beginning or end of the file would be fine. I would then periodically prune the file using an editor to prevent it from becoming too large.

Scott
FieldDir121
Resident Poster
 
Posts: 149
Joined: Mon Aug 02, 2004 5:18 pm

Postby Michael » Wed Jan 11, 2006 6:25 pm

For extracting the ip address see the DisplayOriginatingIPAddress script from the registered users area. It shouldn't be difficult to modify this script to append the ip address to a file.
Michael
Moderator
 
Posts: 866
Joined: Mon Jul 26, 2004 12:14 pm
Location: Victoria BC, Canada

Postby FieldDir121 » Thu Jan 12, 2006 3:50 pm

Michael,

Where would I find the registered user area?

Scott
FieldDir121
Resident Poster
 
Posts: 149
Joined: Mon Aug 02, 2004 5:18 pm

Postby Michael » Thu Jan 12, 2006 6:18 pm

Try looking here.

PS: "Registered users area" is an old term, the new term is "Extras area". - my bad.
Michael
Moderator
 
Posts: 866
Joined: Mon Jul 26, 2004 12:14 pm
Location: Victoria BC, Canada

Postby FieldDir121 » Thu Jan 12, 2006 6:29 pm

Michael,

I still don't understand where "here" is.

How about the address?

Scott
FieldDir121
Resident Poster
 
Posts: 149
Joined: Mon Aug 02, 2004 5:18 pm

Postby Eric » Thu Jan 12, 2006 10:40 pm

Hi Scott,
FieldDir121 wrote:I still don't understand where "here" is.
How about the address?
There's a link on the word 'here' in Michael's previous post.
Click on it. :wink:
Eric
 

Postby FieldDir121 » Sat Jan 14, 2006 8:28 am

Eric,


Thanks. I hadn't noticed that "here" was a link.

I have the script and have run it on a few messages, such as the one that notified me that there was a new reply waiting.

The script returns 127.0.0.1. I have been using the first address in brackets, 67.15.196.12. I don't know enough to know what the difference is. If anyone has a [simple] explanation I would appreciate it.

Receive: lines of header below.

Received: from edge5.adelphia.net ([67.15.196.12]) by mta8.adelphia.net
(InterMail vM.6.01.05.02 201-2131-123-102-20050715) with ESMTP
id <20060113104058.SPZZ18746.mta8.adelphia.net@edge5.adelphia.net>
for <my address>; Fri, 13 Jan 2006 05:40:58 -0500
Received: from srv01.pocosystems.com ([67.15.196.12]) by edge5.adelphia.net
(InterMail vG.2.00.00.02 201-2161-108-103-20050713) with ESMTP
id <20060113104830.VWKW3651.edge5.adelphia.net@srv01.pocosystems.com>
for <my address>; Fri, 13 Jan 2006 05:48:30 -0500
X-ClientAddr: 127.0.0.1
Received: from srv01.pocosystems.com (localhost.localdomain [127.0.0.1])
by srv01.pocosystems.com (8.12.11/8.12.11) with ESMTP id k0DAegOk010904;
Fri, 13 Jan 2006 02:40:42 -0800
Received: (from apache@localhost)
by srv01.pocosystems.com (8.12.11/8.12.11/Submit) id k0DAegBo010902;
Fri, 13 Jan 2006 02:40:42 -0800

Scott
FieldDir121
Resident Poster
 
Posts: 149
Joined: Mon Aug 02, 2004 5:18 pm

Next

Return to PocoScript Help and How-To

Who is online

Users browsing this forum: No registered users and 0 guests

cron