Block host if more than X connections / sessions ( example if more than 25 connections from any host delay delivery with 30 second increments for each additional connection ((message 26 30 second delay message 27 60 second delay message 28 90 second delay)) and if more than 50 connections block all connections from host until connections have dropped for 1 hour (( if mail.spam.net has 51 connections to server something like an iptables rule will block all requests from that host.
postfix snapshot (in IMGate) has recent features called xclient and anvil that will do the kind of rate limiting your are looking for (so recent I have not played with them, yet).
It will check every X minutes to see if connections are closed. Once all connections are closed rule set will self clear, but if another connection attempt is made during deny period counter will reset ))
adding the rate limiting and other IMGate reject features together will cut SMTP connection to your IMail box by 75% up to 95%. That ought to be enough relief.
Delay messages with large to and cc. If email has more than 25 to or cc addresses will delay 10 seconds for each address. (( address 26 wait 10 seconds, process address 27 wait 10 seconds, process address 28 wait 10 seconds, process ..... )
You can limit the max recip per SMTP session to whatever number you want. I'm not a fan of tarpitting since it usually hurts you more that in hurts the attacker.
And of course blacklist, whitelist and custom rule sets.
of course
If there is not something like this on the market I would like to request some help in creating the protection for my server.
IMGate basic config is free for the asking. I install and/or maintain IMGate advanced config commercially.
Len
_____________________________________________________________________ http://MenAndMice.com/DNS-training: London; San Jose IMGate.MEIway.com: anti-spam gateway, effective on 1000's of sites, free
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
