688
edits
Changes
Jump to navigation
Jump to search
Created page with "<span id="_top">Qpsmtpd#Plugins</span> = NAME = geoip - provide geographic information about mail senders. = SYNOPSIS = Use MaxMind's GeoIP data..."
<span id="_top">[[Qpsmtpd#Plugins]]</span>
= [[#___top|NAME]] =
geoip - provide geographic information about mail senders.
= [[#___top|SYNOPSIS]] =
Use MaxMind's GeoIP databases and the GeoIP2 or Geo::IP perl modules to report geographic information about incoming connections.
= [[#___top|DESCRIPTION]] =
Save geographic information about the sender in the following connection notes:
<pre> geoip_country - 2 char country code
geoip_country_name - english name of country
geoip_continent - 2 char continent code
geoip_city - english name of city
geoip_distance - distance in kilometers
geoip_asn - network number</pre>
And adds entries like this to your logs:
<pre> (connect) ident::geoip: NA, US, United States, 1319 km
(connect) ident::geoip: AS, IN, India, 13862 km
(connect) ident::geoip: fail: no results
(connect) ident::geoip: NA, CA, Canada, 2464 km
(connect) ident::geoip: NA, US, United States, 2318 km
(connect) ident::geoip: AS, PK, Pakistan, 12578 km
(connect) ident::geoip: AS, TJ, Tajikistan, 11965 km
(connect) ident::geoip: EU, AT, Austria, 8745 km
(connect) ident::geoip: AS, IR, Iran, Islamic Republic of, 12180 km
(connect) ident::geoip: EU, BY, Belarus, 9030 km
(connect) ident::geoip: AS, CN, China, 11254 km
(connect) ident::geoip: NA, PA, Panama, 3163 km</pre>
Calculating the distance has three prerequsites:
<pre> 1. The MaxMind city database (free or subscription)
2. The Math::Complex perl module
3. The IP address of this mail server (see CONFIG)</pre>
Other plugins can utilize the geographic notes to alter the connection, reject, greylist, etc.
= [[#___top|CONFIG]] =
The following options can be appended in this plugins config/plugins entry.
== [[#___top|distance <IP Address>]] ==
Enables geodesic distance calculation. Will calculate the distance "as the crow flies" from the remote mail server. Accepts a single argument, the IP address to calculate the distance from. This will typically be the public IP of your mail server.
<pre> ident/geoip [ distance 192.0.1.5 ]</pre>
Default: none. (no distance calculations)
== [[#___top|too_far <distance in km>]] ==
Assign negative karma to connections further than this many km.
Default: none
== [[#___top|db_dir </path/to/GeoIP>]] ==
The path to the GeoIP database directory.
<pre> ident/geoip [ db_dir /etc/GeoIP ]</pre>
Default: /usr/local/share/GeoIP
== [[#___top|add_headers <true|false>]] ==
Add message headers with GeoIP data
<pre> ident/geoip [ add_headers (true|false) ]</pre>
Default: true
= [[#___top|LIMITATIONS]] =
The distance calculations are more concerned with being fast than accurate. The MaxMind location data is collected from whois and is of limited accuracy. MaxMind offers more accurate data for a fee.
For distance calculations, the earth is considered a perfect sphere. In reality, it is not. Accuracy should be within 1%.
This plugin does not update the GeoIP databases. You may want to.
= [[#___top|CHANGES]] =
2014-06 - Matt Simerson - added GeoIP2 support
2012-06 - Matt Simerson - added GeoIP City support, continent, distance
2012-05 - Matt Simerson - added geoip_country_name note, added tests
= [[#___top|SEE ALSO]] =
MaxMind: http://www.maxmind.com/
Databases: http://geolite.maxmind.com/download/geoip/database
It may become worth adding support for Geo::IPfree, which uses another data source: http://software77.net/geo-ip/
= [[#___top|ACKNOWLEDGEMENTS]] =
MaxMind - the packager and distributor of the free GeoIP data
Stevan Bajic, the DSPAM author, who suggested SNARE, which describes using geodesic distance to determine spam probability. The research paper on SNARE can be found here: http://smartech.gatech.edu/bitstream/handle/1853/25135/GT-CSE-08-02.pdf
<!-- Generated Mon Apr 8 09:13:56 EDT 2019 using
perldoc -T -ohtml $plugins/$1 \|pandoc -f html -t mediawiki \|sed '1 i\\n\n\n<span id="_top">[[Qpsmtpd#Plugins]]</span>' \|sed -e 's#</d.>##'
-->
----
[[Category:Qpsmtpd|ident/geoip]]
= [[#___top|NAME]] =
geoip - provide geographic information about mail senders.
= [[#___top|SYNOPSIS]] =
Use MaxMind's GeoIP databases and the GeoIP2 or Geo::IP perl modules to report geographic information about incoming connections.
= [[#___top|DESCRIPTION]] =
Save geographic information about the sender in the following connection notes:
<pre> geoip_country - 2 char country code
geoip_country_name - english name of country
geoip_continent - 2 char continent code
geoip_city - english name of city
geoip_distance - distance in kilometers
geoip_asn - network number</pre>
And adds entries like this to your logs:
<pre> (connect) ident::geoip: NA, US, United States, 1319 km
(connect) ident::geoip: AS, IN, India, 13862 km
(connect) ident::geoip: fail: no results
(connect) ident::geoip: NA, CA, Canada, 2464 km
(connect) ident::geoip: NA, US, United States, 2318 km
(connect) ident::geoip: AS, PK, Pakistan, 12578 km
(connect) ident::geoip: AS, TJ, Tajikistan, 11965 km
(connect) ident::geoip: EU, AT, Austria, 8745 km
(connect) ident::geoip: AS, IR, Iran, Islamic Republic of, 12180 km
(connect) ident::geoip: EU, BY, Belarus, 9030 km
(connect) ident::geoip: AS, CN, China, 11254 km
(connect) ident::geoip: NA, PA, Panama, 3163 km</pre>
Calculating the distance has three prerequsites:
<pre> 1. The MaxMind city database (free or subscription)
2. The Math::Complex perl module
3. The IP address of this mail server (see CONFIG)</pre>
Other plugins can utilize the geographic notes to alter the connection, reject, greylist, etc.
= [[#___top|CONFIG]] =
The following options can be appended in this plugins config/plugins entry.
== [[#___top|distance <IP Address>]] ==
Enables geodesic distance calculation. Will calculate the distance "as the crow flies" from the remote mail server. Accepts a single argument, the IP address to calculate the distance from. This will typically be the public IP of your mail server.
<pre> ident/geoip [ distance 192.0.1.5 ]</pre>
Default: none. (no distance calculations)
== [[#___top|too_far <distance in km>]] ==
Assign negative karma to connections further than this many km.
Default: none
== [[#___top|db_dir </path/to/GeoIP>]] ==
The path to the GeoIP database directory.
<pre> ident/geoip [ db_dir /etc/GeoIP ]</pre>
Default: /usr/local/share/GeoIP
== [[#___top|add_headers <true|false>]] ==
Add message headers with GeoIP data
<pre> ident/geoip [ add_headers (true|false) ]</pre>
Default: true
= [[#___top|LIMITATIONS]] =
The distance calculations are more concerned with being fast than accurate. The MaxMind location data is collected from whois and is of limited accuracy. MaxMind offers more accurate data for a fee.
For distance calculations, the earth is considered a perfect sphere. In reality, it is not. Accuracy should be within 1%.
This plugin does not update the GeoIP databases. You may want to.
= [[#___top|CHANGES]] =
2014-06 - Matt Simerson - added GeoIP2 support
2012-06 - Matt Simerson - added GeoIP City support, continent, distance
2012-05 - Matt Simerson - added geoip_country_name note, added tests
= [[#___top|SEE ALSO]] =
MaxMind: http://www.maxmind.com/
Databases: http://geolite.maxmind.com/download/geoip/database
It may become worth adding support for Geo::IPfree, which uses another data source: http://software77.net/geo-ip/
= [[#___top|ACKNOWLEDGEMENTS]] =
MaxMind - the packager and distributor of the free GeoIP data
Stevan Bajic, the DSPAM author, who suggested SNARE, which describes using geodesic distance to determine spam probability. The research paper on SNARE can be found here: http://smartech.gatech.edu/bitstream/handle/1853/25135/GT-CSE-08-02.pdf
<!-- Generated Mon Apr 8 09:13:56 EDT 2019 using
perldoc -T -ohtml $plugins/$1 \|pandoc -f html -t mediawiki \|sed '1 i\\n\n\n<span id="_top">[[Qpsmtpd#Plugins]]</span>' \|sed -e 's#</d.>##'
-->
----
[[Category:Qpsmtpd|ident/geoip]]