block pc in exim.conf directadmin

 I want to block certain botpc's who are always trying to bruteforce.

DA

add the down code juts after begin acl

acl_check_helo:

  #accept email originating on this server unconditionally

  accept  hosts = @[] : @

  # deny if the HELO pretends to be this host

  # EDIT AS REQUIRED TO FIT YOUR ENVIRONMENT

  # EDIT : REPLACE HOSTNAME WITH YOUR HOSTNAME AND IP with your main IP#

  deny message = You cannot be me

       condition = ${lookup{$sender_helo_name}lsearch{/etc/heloblocks}{yes}{no}}

   log_message = HELO/EHLO - HELO on heloblocks Blocklist

   message = HELO on heloblocks Blocklist

   

  accept

cpanel/whm

Thanks to some help on the "Exim Users" mailing list, I have the proper solution:

1) Create a file with a list of the HELOs that you want to block. For example, create and edit /etc/heloblocks

2) Go to WHM > Exim Configuration Manager > Advanced Editor.

3) Scroll down until you find "acl_smtp_helo"

4) Below that, you will find a box titled "custom_begin_smtp_helo". In that box, paste the following code:

Code:

# vi /etc/exim.conf

acl_smtp_helo = acl_smtp_helo
acl_smtp_helo:

#BEGIN ACL_SMTP_HELO_BLOCK

drop
   condition = ${lookup{$sender_helo_name}lsearch{/etc/heloblocks}{yes}{no}}
   log_message = HELO/EHLO - HELO on heloblocks Blocklist
   message = HELO on heloblocks Blocklist
accept

#END ACL_SMTP_HELO_BLOCK

Of course, you can customize the log message and the message (that the end user receives)

5) Scroll down and hit SAVE which will save the config and restart Exim.

If you want to test it out, start up a tail of /var/log/exim_mainlog, and then telnet from your computer like this:

telnet mail.example.com 25
then after receiving the welcome message, type this:
helo ylmf-pc

You should immediately get disconnected and you should see a log message indicating the block.

Now I found this on the internet:

Code:

# vi /etc/exim.conf

acl_smtp_helo = acl_smtp_helo
acl_smtp_helo:

#BEGIN ACL_SMTP_HELO_BLOCK
drop
   condition = ${if eq {$sender_helo_name}{ylmf-pc} {yes}{no}}
   log_message = HELO/EHLO - ylmf-pc blocked
   message = I Nailed You at HELO
accept