FUT, that's what I'd mutter when yet another blast of SPAM for email addresses that didn't exist were delivered to my MTA. Then I heard Merlyn give his You had me at HELO talk. Great solution, monitor mail logs and when a spammer tries to send email to a non-existant address at your site slam the IP door shut on the session. The only problem was, he uses BSD and pf, while I run Linux systems with netfilter/IPTables.

I set out to see if I could implement what he described. With a few digressions, like making the program handle arbitrary events like bogus SSH login attempts, I implemented a program that will monitor logs for email, ssh access, or whatever you define watching for unwanted activity - like an attempt to deliver email to a non-existent user - and create a temporary iptables rule to block access from the miscreant that is trying to abuse your system.

FUT is that program. If you run Linux systems and want to slam the IP door on miscreants (scum) who are abusing your system it may be of interest.

All feedback, pointers to needed code improvement, and patches appreciated.

Ahem, especially pointers for needed code improvement. There's a memory leak and that's no good for something intended to run as a daemon.