Fail2ban ispeziona i log file (ad es. /var/log/apache/error_log) e banna IPs che mostrano un comportamento sospetto -- troppe password sbagliate, tentativi di exploits, etc. Generalmente Fail2Ban è quindi usato per aggiornare le regole del firewall al fine di rigettare gli indirizzi IP durante un intervallo di tempo settabile, benchè ogni altra azione (come l'invio di una mail di notifica) può anche altresì essere impostata. Tra le altre cose Fail2Ban mette a disposizione dei filtri per diversi servizi come apache, courier, ssh, etc.
Mostrerò brevemente come installare e configurare fail2ban per rigettare le connessioni di IP sospetti, specialmente quelli riguardanti la patch qmail-dnsrbl. Ciò evita di essere bannati noi stessi da spamhaus, che è gratuito solo fino a 100.000 query al giorno.
fail2ban richiede che si abbia un firewall come nftables o iptables attivo.
Changelog
Aug 16, 2026 - Fail2Ban upgraded to v. 1.1.1 (changelog)
Nov 8, 2025 - qmailadmin log file is now /home/vpopmail/log/qmailadmin-auth.log
Mar 14, 2025 - dovecot filter updated for dovecot 2.4
NASA’s COFFIES Uses AI to Predict Storm-Causing Active Regions on Sun
As humanity looks to the Moon and stars for future exploration, predicting space weather — conditions in space primarily driven by the Sun — is more important than ever.
Now, a team of astrophysicists and data scientists with NASA’s COFFIES (Consequence Of Fields and Flows in the Interior and Exterior of the Sun) has developed a novel machine-learning model capable of predicting the emergence of active regions on the Sun up to 12 hours before they appear.
The Sun is constantly churning. Intense concentrations of localized magnetic fields can suddenly break through the solar surface, forming sunspots. Space weather forecasters then collectively number and track sunspots since they are visible manifestations of active regions, which serve as the main engines behind severe space weather events such as solar flares and coronal mass ejections. These eruptions send waves of high-energy radiation and charged particles across space, creating storms that can threaten astronauts, disable satellites, and disrupt radio communications on Earth.
NASA’s Solar Dynamics Observatory captured this image of a solar flare — seen as the bright flash in the upper right — on June 30, 2026. The image shows a subset of extreme ultraviolet light that highlights the extremely hot material in flares and which is colorized in teal.
NASA’s Goddard Space Flight Center/SDO
By bridging expertise across different scientific institutions, COFFIES, a NASA DRIVE (Diversify, Realize, Integrate, Venture, Educate) Science Center, brought together a team of researchers from New Jersey Institute of Technology (NJIT), Princeton University, and NASA’s Ames Research Center in California’s Silicon Valley. The team turned to advanced artificial intelligence architectures — which dictate how data is processed and used to produce reliable predictions or actions — to capture subtle, time-based pattern changes on the solar surface before an active region took shape. By analyzing data captured by the agency’s Solar Dynamics Observatory and using NASA Ames’ supercomputing resources, this new approach, published in the Journal of Geophysical Research: Machine Learning and Computation, looks at fluctuations in acoustic waves caused by sunspot regions when the regions form beneath the solar surface and begin the journey upward to emerge on the surface.
“We cannot directly see the magnetic structure while it is still rising through the solar interior. Instead, we must look for indirect effects — very small changes in the magnetic field and in the pattern of acoustic waves continually traveling through the Sun,” said Alexander Kosovichev, a COFFIES co-investigator at NJIT. “The developed technique identifies precursors associated with an emerging active region in slight changes of the Sun’s acoustic power — more like a slight change in rhythm within a very noisy orchestra.”
This video is an example of what scientists use when analyzing the solar surface. This particular time frame tracks the magnetic field on the Sun’s surface during the emergence of active region AR11158 in February 2011. The blue square grid highlights a target area on the Sun. The squares on the right side translates the data from the target grid area to show opposing magnetic polarities, indicated by the warm and cool-colored tones. The first column of blocks shows targeted areas at original resolution, the middle column displays data as 2D maps, and the right column plots changes in magnetic polarity over time as 1D curves. By watching these blocks, scientists can see signs of active region emergence, such as drops in acoustic waves and rises in magnetic fields.
NASA’s COFFIES DRIVE Science Center/Irina Kitiashvili and Spiridon Kasapis
To develop current operational forecasts, the National Oceanic and Atmospheric Administration’s Space Weather Prediction Center and the United States Air Force monitor active regions that are already visible on the Sun to analyze the regions’ characteristics and estimate the probability of solar flares.
The COFFIES team aims to revolutionize this process. The AI model the team developed a specialized early detection system to handle very long sequences of data — called sliding-window transformer architecture — to use observations to find tiny reductions in the Sun’s acoustic activity and magnetic field, signals that scientists struggled to capture until now. These reductions form patterns that the AI model uses to predict active regions several hours before they become visible on the solar surface. Instead of looking at all activity on the solar surface at once, like earlier deep learning approaches have done, this new model moves a fixed-size “viewing window” across a long timeline of the Sun’s activity to focus on recent data while remembering overall patterns. This method allows forecasters the ability to predict approximate locations of emerging sunspots, rather than relying on counting already visible sunspots.
This promising AI architecture shows how deep machine learning can contribute to heliophysics — the field studying the nature of the Sun and how it influences the very nature of space and the planets that exist there. While the model is not ready for operational real-time forecasting, the team plans to validate the approach across many more known solar events to fine-tune the model.
NASA’s real-time space weather monitoring
As NASA focuses on sending humans to explore the Moon with the Artemis missions and sending the first crewed missions to Mars, monitoring and forecasting space weather is important for ensuring the safety of our astronauts and the equipment they rely on. This predictive leap from the COFFIES team could prove vital for safeguarding technology and deep-space explorers from the volatile environment of our solar system.
NASA’s Moon to Mars Space Weather Analysis Office monitors space weather 7 days a week. This important work helps decision makers not only protect people and equipment but maintain the services our modern society relies on every day. NASA’s space weather monitoring is also critical for safeguarding astronauts as they journey to the Moon and onward to Mars.
NASA/Lacey Young
Teams across NASA and NOAA collaborate to transition research capabilities into actual 360-degree space weather monitoring operational tools — including NASA’s Space Radiation Analysis Group, Moon to Mars Space Weather Analysis Office (M2M SWAO), and Community Coordinated Modeling Center as well as NOAA’s Space Weather Prediction Center. Sunspot region emergence prediction capabilities, especially of the Sun’s far side, could provide new information that supplements current models used by these teams.
“The COFFIES AI model is exciting to our team because it could provide us with new capabilities towards predicting potential flaring locations ahead of time,” said Michelangelo Romano, M2M SWAO deputy director. “With this heads up, we can provide additional support to NASA missions.”
NASA’s COFFIES is one of three DRIVE Science Centers created to encourage collaborative science by establishing centers that are made of multidisciplinary teams from several institutions across the U.S. These pioneering facilities employ modelers, theoreticians, computer scientists, and observers to study important mysteries of our star and its influence, a branch of science known as heliophysics.
The COFFIES team focuses on the interconnected processes behind the Sun’s activity. Understanding the Sun’s interior and magnetic variability is key to advancing our understanding of the Sun’s 11-year activity cycle and fine-tuning space weather forecasting tools.
Le SURBL sono liste di siti web che appaiono nel corpo della posta indesiderata. Diversamente dalla maggior parte delle liste non sono liste di indirizzi IP.
I siti web che appaiono nei messaggi di posta indesiderata tendono ad essere più stabili rispetto agli indirizzi IP in rapido cambiamento dei botnet che sono soliti inviare la maggior parte di questi messaggi. Le liste di IP come zen.spamhaus.org possono essere usate in un primo stadio di filtraggio per aiutare a identificare da circa l'80% al 90% dei messaggi di posta indesiderata. Le liste SURBL possono contribuire a eliminare il restante 75% della posta indesiderata in un successivo stadio di filtraggio. Usate insieme alle liste di IP (RBL), le SURBL risultano un metodo molto efficace per identificare fino al 95% della posta indesiderata.
Changelog
Mar 29, 2026 - aggiunta una nota sui control file
Feb 17, 2026 - added notes to testing section
Sep 26, 2023 -surblfilter logs the rejected URL in the qmail-smtpd log. It can now inspect both http and https URLs. -Improvements in man dkim.9, qmail-dkim.9 and surblfilter.9
May 17, 2023 -Top level domains URL is changed. So you have to adjust the update_tlds.sh script accordingly
qmail-spp provides plug-in support for qmail-smtpd. It allows you to write external programs and use them to check SMTP command argument validity. The plug-in can trigger several actions, like denying a command with an error message, logging data, adding a header and much more.
Today I played for the first time with an ancient patch for qmail: qmail-spp. I was really impressed for the ease of use and the elegance of its code, which is inserted inside qmail-smtpd.c with a few touches, despite of the many things that it can do when installed and enabled.
It can run a custom plugin in any language and at any level of the smtp session, grabbing the environment variables, writing into stderr or blocking the smtp session with a return error for the sender.
In no time at all I managed to understand its logic and write a small plugin by adapting a c program I wrote for s/qmail a few months ago to check the validity of the recipient.
Of course I decided to add this patch to my combo. I've just modified the way it has to be enabled, just not to bother those who don't want to touch their run scripts. So, while the original patch is enabled by default, I modified things a little bit so that you have to manually enable it by exporting the variable ENABLE_SPP in your run scripts. Therefore the original NOSPP variable is useless.
Ora che abbiamo preparato i filtri antispam dobbiamo addestrare il nostro sistema bayesiano e inviare i report a Razor, Pyzor e Spamcop.
La cosa più ovvia che può venirci in mente di fare a questo punto è forse quella di lanciare sa_learn e spamassassin --report uno dopo l'altro al click sul bottone "Marca come Spam" della webmail Roundcube (vedere i driver cmd_learn e multi_driver del plugin markasjunk), ma questa scelta ha alcuni svantaggi importanti:
il processo di addestramento, la conseguente sincronizzazione del journal e la connessione ai vari network per il reporting può richiedere anche una decina di secondi, un tempo che i nostri utenti non sono disposti ad attendere.
cosa anche più grave, quando essi cliccano sul bottone "Marca come Spam" non è sempre detto che si tratti di un vero messaggo di posta indesiderata. Prendiamo ad esempio il classico caso delle newsletter a cui si sono regolarmente iscritti e che non vogliono più leggere, e che decidono di eliminare etichettandole come spamming anzichè inoltrare una regolare richiesta di cancellazione.
E' qundi più corretto eseguire questi due compiti durante la notte per mezzo di un cronjob (primo problema risolto), processando i soli messaggi di vero spam/ham che l'utente ha consapevolmente copiato in una cartella apposita (secondo problema).
Accedi
