Monday, July 12, 2004 you wrote:
DD> Is there anything that can be done in Imail to block or stop
DD> dictionary attacks?
No.
DD> I had several in a row this morning that totally consumed our
DD> bandwidth ...
Yes, it is a terrible problem. The largest I've had has been
about 8,000 invalid rcpt to's in a single session.
DD> It would be nice if Imail had someway to detect this type of attack,
DD> log the IP and refuse connections from it for a set period of time.
Yes.
I tried for a while a scheme where I did this from the log files
and then wrote an entry to the acl. But this is ineffective and
does not interrupt the smtp dialog.
Some have had success using BlackIce but it has never worked for
us and it has caused errors with our server.
My most effective means right now is using the ASSP proxy. I
modified the code to count up to 10 550 errors and if that is
reached to disconnect. I've been testing on my secondary servers
and it is working better than I could have hoped.
I'm going to implement on our main IMAIL server but I'm
experimenting with some of the other aspects of ASSP.
Terry Fritts
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
