From 49afe317a0c51152239d67b251602dd364c17cf9 Mon Sep 17 00:00:00 2001
From: Damien De Paoli <ddp@depaoli.id.au>
Date: Sat, 16 Aug 2025 10:32:51 +1000
Subject: [PATCH] wrapper to force fail2bans for dodgy CONNECT froms that are
 more than 100 times - not sure I use this anymore

---
 ban-mail-abusers | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100755 ban-mail-abusers

diff --git a/ban-mail-abusers b/ban-mail-abusers
new file mode 100755
index 0000000..d06deea
--- /dev/null
+++ b/ban-mail-abusers
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+for i in `docker logs mail | grep "CONNECT from" | awk -F'[' '{print $3}' | cut -f1 -d']' | sort | uniq -c | sort -n  | awk '{ if ( $1 > 100)  print $2 }'`; do 
+    echo docker exec -it mail fail2ban ban $i;
+done