https://bugs.koozali.org/show_bug.cgi?id=11771
--- Comment #21 from [email protected] ---
Thanks for this Brian.
[Now a user writes with some stats that might be useful... I've just wound up
my old awk expertise to run a quick analysis of the qpsmtpd logs - such as
still remain - from this event.]
The numbers that follow refer to the target addressees - so one email submitted
by the mailbomber with 20 "to" addresses counts as 20 emails - for that is the
number my qmail attempted to deliver.
In these logs, each of 4.77mb, there are about 13k target email addresses
Each log file filled up in about 30 seconds.
Of the logs I have either on my live system or from backup I count 113k
outgoing emails.
The missing logs, rotated out of existence and not caught by my 24 hour backup
cycle, cover a period of about 20 minutes from the start at 22:25 on Friday
19th running to 22:43. That could therefore mean another 40 or so batches of
13k emails = 520k emails.
Added to the recorded 112k that gives a total of say 632k attempted deliveries.
This was all curtailed by me stopping qmail or/and qpsmtpd as soon as I
discovered what was going on.
I noted at one point that the email submissions have a comment included "night
time" so the bombing was deliberately scheduled to be overnight for me.
There are very few duplicates but one is of interest <[email protected]>
which I suspect might be the bomber's monitoring address. It is also on the
reply-to of each email. I am going to write to it using another account to see
if I get a response.
It surely cannot be beyond the wit of a qpsmtpd plugin to see this sort of
thing happening in real time and put some kind of brakes on so I shall visit
the relevant git and see what can be done...
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
Mail for each SME Contribs bug report
To unsubscribe, e-mail [email protected]
Searchable archive at https://lists.contribs.org/mailman/public/contribteam/
