Re: Directory Harvest

2009-07-30 Thread Ralf Hildebrandt
* Evan Platt e...@espphotography.com: At 03:59 PM 7/29/2009, you wrote: It looks like somebody is trying to figure out my internal users as evidenced by log excerpts below. Is there something I could do to, if not prevent this, reduce it? If you're seeing a lot of attempts, I say just

Re: Directory Harvest

2009-07-30 Thread Clunk Werclick
On Thu, 2009-07-30 at 08:59 +0200, Ralf Hildebrandt wrote: * Evan Platt e...@espphotography.com: At 03:59 PM 7/29/2009, you wrote: It looks like somebody is trying to figure out my internal users as evidenced by log excerpts below. Is there something I could do to, if not prevent this,

Re: Directory Harvest

2009-07-30 Thread Barney Desmond
Apart from the IPTables a more autonomous fix could be done with the (improper ?) use of Anvil. Any more than X connections in a couple of minutes and goodnight sweetheart. This is generally strongly advised against. anvil is a DoS-protection mechanism, not a rate-limit tool - it exists to

Re: Directory Harvest

2009-07-30 Thread Roman Gelfand
This is excellent. If you have other non-content spam filtering suggestion, I would greatly appreciate it. On Wed, Jul 29, 2009 at 9:23 PM, Noel Jones njo...@megan.vbhcs.org wrote: Roman Gelfand wrote: It looks like somebody is trying to figure out my internal users as evidenced by log

Re: Directory Harvest

2009-07-30 Thread Noel Jones
Roman Gelfand wrote: This is excellent. If you have other non-content spam filtering suggestion, I would greatly appreciate it. You post in HTML, and you top-post. Please observe list etiquette if you want further answers. As someone else already pointed out, the client also used a

Re: Directory Harvest

2009-07-29 Thread Evan Platt
At 03:59 PM 7/29/2009, you wrote: It looks like somebody is trying to figure out my internal users as evidenced by log excerpts below. Is there something I could do to, if not prevent this, reduce it? If you're seeing a lot of attempts, I say just block them in your firewall... # whois

Re: Directory Harvest

2009-07-29 Thread Roman Gelfand
Should I block 1 address or subnet? On Wed, Jul 29, 2009 at 7:05 PM, Seth Mattinen se...@rollernet.us wrote: Roman Gelfand wrote: It looks like somebody is trying to figure out my internal users as evidenced by log excerpts below. Is there something I could do to, if not prevent this,

Re: Directory Harvest

2009-07-29 Thread Seth Mattinen
Roman Gelfand wrote: Should I block 1 address or subnet? I'd start with just the IP, personally. ~Seth

Re: Directory Harvest

2009-07-29 Thread Noel Jones
Roman Gelfand wrote: It looks like somebody is trying to figure out my internal users as evidenced by log excerpts below. Is there something I could do to, if not prevent this, reduce it? Thanks in advance Jul 29 15:00:14 mail postfix/smtpd[2448]: NOQUEUE: reject: RCPT from

Re: Directory Harvest

2009-07-29 Thread Benny Pedersen
On Thu, July 30, 2009 00:59, Roman Gelfand wrote: It looks like somebody is trying to figure out my internal users as evidenced by log excerpts below. Is there something I could do to, if not prevent this, reduce it? reject more helo ? the shown logs was all not fqdn helo -- xpoint