we suffered this months ago in that it filled up the disk and shut down the server because the disk was full.
we protect against this now with running imgate as our internet available mail server and keep it updated with the valid users on our imail server. when dict attacks come, they hit the imgate box and because they are not valid accounts, get rejected. other advantage is that the imail box does not have to be advertised on the internet or take resources to deliver/receive mail from outside servers, it only deals with imgate. just one of the advantages of imgate, I see many... bob On Thursday, April 8, 2004 10:43 AM, A. Clausen <[EMAIL PROTECTED]> wrote: > >----- Original Message ----- >From: "R. Scott Perry" <[EMAIL PROTECTED]> >To: <[EMAIL PROTECTED]> >Sent: Thursday, April 08, 2004 07:56 >Subject: RE: [IMail Forum] smtpd32.acc > > >> >> >The structure of the file isn't too difficult to determine with a hex >editor >> >and a little time. It's divided into 4 byte records and the first 3 >records >> >(or 12 bytes) are always the same. The rest is pretty obvious after you >> >play with it a little. >> >> I beg to differ. >> >> It's those 12 byte that are "always the same" that cause the problem. Why >> are they always the same? What is always the same on your server, that >> might be different on someone else's server? Do you think IMail really >> included 12 bytes that never change? >> >> That's why we don't touch those access files. Until/unless Ipswitch >> documents the format, we don't feel it is safe to alter those >files. > >That still leaves me high and dry. It shouldn't be too difficult to squeeze >out the information from the log files using reasonably good ports of grep, >tail and awk. The problem is what to do with it. I have thought about >dynamically generating ACLs on our Cisco router, but that comes with its own >pitfalls. The IMail access list would be the obvious place to do this, but >I also don't want to jeopardize the stability of the server. > >The fact is that in the last week, we've been hit very hard by distributed >dictionary attacks. While the machine is holding up now, it managed to fill >up the queue at one point on our backup mail server (running MS's SMTP >service). I've corrected the situation, but if those attacks were to >double, I suspect we'd be in real trouble. I don't want to start blocking >entire subnets. That's what I think RoadRunner has done to us, creating >problems for our customers. As well, I have no interest in putting BlackIce >on our server, which as far as I'm concerned would only >complicate things. > >Surely there must be some sort of solution to all of this. > >-- >A. Clausen >[EMAIL PROTECTED] > > > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
