Matthijs Kooijman - 2009-09-10

This actually looks like a nice idea: To watch the SMTP logs and ban any IP that repeatedly tries to send spam. I'm not sure how effective this is (on my Exim installation, most IP's only try one or two messages and stop trying if those are rejected).

Also, my exim keeps a file /var/log/rejectlog logging all rejections. Some appropriate fai2ban configuration and regex should probably enable you to parse this logfile already and make this work. If you manage to create such a configuration, please include it here, which will make it much more likely it will be included in fail2ban.