Michelle Konzack writes:
Hello Sam,Am 2008-10-26 14:40:22, schrieb Sam Varshavchik:Courier will already do pretty well to block most bombs. The combination of limiting connections from the same IP address range, and automatic tarpitting of SMTP errors, will usually be enough for most cases.Is there a way limiting the messages coming from one IP/relay per day? Since some days I become bombed by over 700.000 backscatters now my 78.000 users are bombed...
No, there isn't a direct way to do it. However, since everything gets logged, including IP addresses. You may want to look into putting together a script that goes through syslog and collects this information.
For example, from my own logs:Nov 7 02:37:40 headache courieresmtpd: error,relay=::ffff:125.86.103.152,from=<[EMAIL PROTECTED]>, to=<[EMAIL PROTECTED]>: 550 User <dianec2cheek> unknown
It's all one line. It should be fairly simple to grep syslog for "User * unknown", then grab the IP address, and ban it.
pgpF4HlbRK6jP.pgp
Description: PGP signature
------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________ courier-users mailing list [email protected] Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
