I am with Kris, thats a great solution, we just in planning here. And of course, deleting all "nobody" aliases...
marc.
At 19:17 21.09.2004, you wrote:
>I had two gateways running declude, both boxes were Dual Xeon 2.8Ghz, 2GB
>Ram, 3x36Gb 15K scsi, 128MB Raid controller and both boxes could not handle
>the load when this happened to me. In the last week and a half I put up a
>postfix(Imgate) gateway. This one box is doing what 2 of the others could
>not do. I take in about 3.1 Million messages a day at a 98% reject rate!
>So in my opinion Postfix at the gateway level is the only way to go. I
>still run declude virus pro on my mail box server and am very satisfied.
>
>
>
>Thanks,
>
>
>Kris McElroy
>[EMAIL PROTECTED]
>
>Chief Technology Officer
>Duracom, INC.
>www.duracom.net
>
>-----Original Message-----
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze
>Sent: Tuesday, September 21, 2004 11:34 AM
>To: [EMAIL PROTECTED]
>Subject: RE: [Declude.Virus] Attack?
>
>I've seen this happening with us for a while now.. I started tracking the IP
>addresses to try and have iMail block them, but I would have to enter them
>manually and wasn't going to do that.. Way too many.. Hahaha
>
>I think the only way to really fix this (what I've been looking at and
>trying to implement) is to setup a postfix mail gateway for messages as they
>come in and have it checked against a database of good e-mail accounts (can
>be edited locally or looked up via LDAP).. If they're legit, they're
>forwarded to the iMail server.. If not, they're dropped at the gateway..
>Just been busy with other things to try and track this how-to down..
>
>-----Original Message-----
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED] On Behalf Of Stan Buck
>Sent: Tuesday, September 21, 2004 11:50 AM
>To: [EMAIL PROTECTED]
>Subject: [Declude.Virus] Attack?
>
>For three days now we've been getting these emails addressed to random
>strings every few minutes. IPs keep changing. Sometimes one mail per IP,
>sometimes several. What is this? Zombie computers? Forged IPs? And how
>many hits are you going to get with random strings?
>
>09:21 00:00 SMTPD(54FA0120) [10.0.0.109] connect 216.167.161.91 port 34112
>09:21 00:00 SMTPD(54FA0120) [216.167.161.91] EHLO pop3.nts-online.net
>09:21 00:00 SMTPD(54FA0120) [216.167.161.91] MAIL FROM:<>
>09:21 00:00 SMTPD(54FA0120) [216.167.161.91] RCPT
>TO:<[EMAIL PROTECTED]>
>09:21 00:00 SMTPD(54FA0120) [216.167.161.91] ERR mdchildcare.org invalid
>user <[EMAIL PROTECTED]
>09:21 00:01 SMTPD(56180120) [10.0.0.109] connect 131.103.218.79 port 20368
>09:21 00:01 SMTPD(56180120) [131.103.218.79] HELO mail15a.boca15-verio.com
>09:21 00:01 SMTPD(56180120) [131.103.218.79] MAIL FROM:<>
>09:21 00:01 SMTPD(56180120) [131.103.218.79] RCPT
>TO:<[EMAIL PROTECTED]>
>09:21 00:01 SMTPD(56180120) [131.103.218.79] ERR mdchildcare.org invalid
>user <[EMAIL PROTECTED]
>09:21 00:14 SMTPD(6B9E0124) [10.0.0.109] connect 64.29.144.72 port 49234
>09:21 00:14 SMTPD(6B9E0124) [64.29.144.72] EHLO mx305.megamailservers.com
>09:21 00:14 SMTPD(6B9E0124) [64.29.144.72] MAIL From:<>
>09:21 00:14 SMTPD(6B9E0124) [64.29.144.72] RCPT To:<[EMAIL PROTECTED]>
>09:21 00:14 SMTPD(6B9E0124) [64.29.144.72] ERR mdchildcare.org invalid user
><[EMAIL PROTECTED]
>09:21 00:14 SMTPD(6BB80124) [10.0.0.109] connect 206.190.36.133 port 20018
>09:21 00:14 SMTPD(6BB80124) [206.190.36.133] HELO mta137.mail.re2.yahoo.com
>09:21 00:14 SMTPD(6BB80124) [206.190.36.133] MAIL FROM:<>
>09:21 00:14 SMTPD(6BB80124) [206.190.36.133] RCPT
>TO:<[EMAIL PROTECTED]>
>09:21 00:14 SMTPD(6BB80124) [206.190.36.133] ERR mdchildcare.org invalid
>user <[EMAIL PROTECTED]
>
>---
>[This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.Virus mailing list. To unsubscribe, just
>send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.Virus". The archives can be found
>at http://www.mail-archive.com.
>
>
>
>---
>[This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.Virus mailing list. To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.Virus". The archives can be found
>at http://www.mail-archive.com.
>
>---
>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
>
>---
>This E-mail came from the Declude.Virus mailing list. To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.Virus". The archives can be found
>at http://www.mail-archive.com.
>
>[Scanned for viruses by Declude Virus]
[Scanned for viruses by Declude Virus]
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
