9 messages in net.sourceforge.lists.courier-usersRe: [courier-users] Same problem with...
FromSent OnAttachments
Michelle KonzackSep 28, 2007 2:46 am 
Sam VarshavchikSep 28, 2007 4:05 am 
João ValeSep 28, 2007 4:23 am 
Michelle KonzackSep 28, 2007 5:54 am 
Jeff JansenSep 28, 2007 7:09 am 
Michelle KonzackSep 28, 2007 7:49 am 
Jeff JansenSep 28, 2007 8:33 am 
Gordon MessmerSep 28, 2007 11:19 am 
Tim LythSep 28, 2007 7:17 pm 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:Re: [courier-users] Same problem with courier-mta as with exim [FW by XXXX@XXXXX.XXX : Re: Dictionary spamming ?]Actions...
From:Sam Varshavchik (mrs@courier-mta.com)
Date:Sep 28, 2007 4:05:51 am
List:net.sourceforge.lists.courier-users

Michelle Konzack writes:

Since arround one week I have very heavy Dictionary attacs (over 300000 per day from more then 7000 different IP's) on my courier-mta which servs for 17.000 users in the french gov.

On the <exim-user> list they used the following to stop it.

But how can I do this with <courier-mta>?

I like to reduce the faild connection per IP to 10 per hour and I think, this is enough to will heavy slow down the hack attempts...

There is no rate metering of this kind possible, but what exactly is the negative impact from this? This is an average of three and a half probes per second, which, if you weren't looking at the logs, you would've never noticed.

The reason it's only three and a half probes per second is, of course, Courier's automatic tarpit. Without it you'll probably have thirty million probes per day. So you have a lot of crap in your mail logs. So what. It's not the end of the world.

You should consider using the CBL blacklist, which probably has most of these compromised hosts listed, already. This won't have much impact on the probes, but should cut down on the spam.