Actually there is a batch file that runs on the imail server that exports the users out to a .txt file then uploads them to the gateway server. I actually was in a real bind, since my mail was not coming through and slowed delivery to 8 hours plus, so I contacted Len Conrad to do the install for me. I am not very proficient with FreeBsd, but it is not as hard as I though that it would be.
Thanks, Kris McElroy [EMAIL PROTECTED] Chief Technology Officer Duracom, INC. www.duracom.net -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze Sent: Tuesday, September 21, 2004 12:34 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Attack? Was there a how-to that you followed to set this up, or did you just do a search and take a little here, and a little there to finally get your setup? Also, do you manually enter legit e-mail addresses locally or have them looked up via LDAP, or something else.. Thanks.. -Jeff -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kris McElroy Sent: Tuesday, September 21, 2004 1:17 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Attack? I had two gateways running declude, both boxes were Dual Xeon 2.8Ghz, 2GB Ram, 3x36Gb 15K scsi, 128MB Raid controller and both boxes could not handle the load when this happened to me. In the last week and a half I put up a postfix(Imgate) gateway. This one box is doing what 2 of the others could not do. I take in about 3.1 Million messages a day at a 98% reject rate! So in my opinion Postfix at the gateway level is the only way to go. I still run declude virus pro on my mail box server and am very satisfied. Thanks, Kris McElroy [EMAIL PROTECTED] Chief Technology Officer Duracom, INC. www.duracom.net -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze Sent: Tuesday, September 21, 2004 11:34 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Attack? I've seen this happening with us for a while now.. I started tracking the IP addresses to try and have iMail block them, but I would have to enter them manually and wasn't going to do that.. Way too many.. Hahaha I think the only way to really fix this (what I've been looking at and trying to implement) is to setup a postfix mail gateway for messages as they come in and have it checked against a database of good e-mail accounts (can be edited locally or looked up via LDAP).. If they're legit, they're forwarded to the iMail server.. If not, they're dropped at the gateway.. Just been busy with other things to try and track this how-to down.. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Stan Buck Sent: Tuesday, September 21, 2004 11:50 AM To: [EMAIL PROTECTED] Subject: [Declude.Virus] Attack? For three days now we've been getting these emails addressed to random strings every few minutes. IPs keep changing. Sometimes one mail per IP, sometimes several. What is this? Zombie computers? Forged IPs? And how many hits are you going to get with random strings? 09:21 00:00 SMTPD(54FA0120) [10.0.0.109] connect 216.167.161.91 port 34112 09:21 00:00 SMTPD(54FA0120) [216.167.161.91] EHLO pop3.nts-online.net 09:21 00:00 SMTPD(54FA0120) [216.167.161.91] MAIL FROM:<> 09:21 00:00 SMTPD(54FA0120) [216.167.161.91] RCPT TO:<[EMAIL PROTECTED]> 09:21 00:00 SMTPD(54FA0120) [216.167.161.91] ERR mdchildcare.org invalid user <[EMAIL PROTECTED] 09:21 00:01 SMTPD(56180120) [10.0.0.109] connect 131.103.218.79 port 20368 09:21 00:01 SMTPD(56180120) [131.103.218.79] HELO mail15a.boca15-verio.com 09:21 00:01 SMTPD(56180120) [131.103.218.79] MAIL FROM:<> 09:21 00:01 SMTPD(56180120) [131.103.218.79] RCPT TO:<[EMAIL PROTECTED]> 09:21 00:01 SMTPD(56180120) [131.103.218.79] ERR mdchildcare.org invalid user <[EMAIL PROTECTED] 09:21 00:14 SMTPD(6B9E0124) [10.0.0.109] connect 64.29.144.72 port 49234 09:21 00:14 SMTPD(6B9E0124) [64.29.144.72] EHLO mx305.megamailservers.com 09:21 00:14 SMTPD(6B9E0124) [64.29.144.72] MAIL From:<> 09:21 00:14 SMTPD(6B9E0124) [64.29.144.72] RCPT To:<[EMAIL PROTECTED]> 09:21 00:14 SMTPD(6B9E0124) [64.29.144.72] ERR mdchildcare.org invalid user <[EMAIL PROTECTED] 09:21 00:14 SMTPD(6BB80124) [10.0.0.109] connect 206.190.36.133 port 20018 09:21 00:14 SMTPD(6BB80124) [206.190.36.133] HELO mta137.mail.re2.yahoo.com 09:21 00:14 SMTPD(6BB80124) [206.190.36.133] MAIL FROM:<> 09:21 00:14 SMTPD(6BB80124) [206.190.36.133] RCPT TO:<[EMAIL PROTECTED]> 09:21 00:14 SMTPD(6BB80124) [206.190.36.133] ERR mdchildcare.org invalid user <[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
