Adam,
Saturday, December 21, 2002 you wrote:
AC> I am interpreting this right as what is going on?
Yes. It is called a dictionary attack.
AC> Is there any way to stop this?
There has been a lot of discussion - search in archives for
dictionary attack, access control, etc.
There are a few ways to approach the problem:
1) set up a nobody account so that all domain recipients are
accepted. This basically prevents the attacks but will
increase (and frequently drastically increase) your spam
traffic.
2) Block the originating server
a) the most common way to do this is to add the IP address to
your Control Access List.
i) I did write an automatic program to do this but finally
discontinued it as it became too difficult to manage
b) Roger Heath reports good success with Black Ice Server which
will automatically block an IP at the server level for
various error types. In this case it is "too many errors".
However, our own experience with Black Ice is not so good.
Yesterday for instance it still allowed 4 attacks and one
with 450 rcpt to attempts. The previous day it allowed 11
and two attacking ips were allowed 290 attempts. This is
however better than what we sometimes experience. We've had
hundreds of attacks in a single day and we've recorded
rcpt-to requests in the thousands if unchecked at all.
c) one issue with blocking is that the attacker frequently
switches to any backup mx - and that presents an entirely
different problem
3) Len's IMGATE uses a postfix setting to limit errors and drop
the connection - he's also been working on an ipfilter system
to block and deblock for a time
AC> Such as perhaps if someone generated more than X SMTP ERR
AC> entries in a N minute period they will get blocked for while?
Yes, I would like to see IMAIL include such a feature but there
has been no indication such a thing is planned. I have also not
found other spam blocking software that renders much protection in
this regard either.
Mike Lewinski wrote a perl program that checks logs for such attacks
that might interest you - see http://www.rockynet.com/imail/
Sorry you're having the attack - likely won't be the last - if your
experience is anything like mine.
Terry Fritts
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
