My expiry time was actually 12 hours. We were SERIOUSLY getting beat down by these things, a result of a poorly implemented Imail server as backup MX, which accepted ALL mail and forwarded to the primary. Not good when a mail server accepts all dictionary attack attempts. I posted a graph to the list a while back that showed 2-300K attempts per day, with less than 10,000 per day accepted by the postfix box and passed on to Imail.
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don Schreiner Sent: Friday, April 08, 2005 11:21 AM To: [email protected] Subject: RE: [IMail Forum] Account Harvesting Not knocking IMGate (the best for this!), but if you shorten your expiry block time on the SMTP (i.e. 4-12 hours) then Black Ice will not get bogged down. We experimented with this and had good results. Of course it depends on the volume of dictionary attacks. I imagine a server with huge dictionary attack traffic would still get bogged down regardless - and something along the lines of IMGate would be required. -Don -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Horne Sent: Friday, April 08, 2005 10:54 AM To: [email protected] Subject: RE: [IMail Forum] Account Harvesting I agree. When we had this problem, we originally set up Black Ice Server Protection on our MX, and used the config edits posted to the list to enable blocking of any IP address with more than X SMTP ERR's in Y minutes. Within a day, that list had over 25,000 IP addresses in it and the Black Ice Server was bogging down the MX as bad or worse than the dictionary attacks themselves. So we went with IMGate, and later just postfix (not my decision, the uppers didn't like IMGate's restrictive policies, so we're only using it to run interference for the dictionary attacks) as a gateway to Imail. We have never looked back. The itty bitty postfix box, dual p2 333's is brushing the dictionary attacks away like horseflies, where the dual 2.4GHz Xeon w/HT running Imail simply couldn't keep up. -Dan Horne -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Len Conrad Sent: Thursday, April 07, 2005 5:33 PM To: [email protected] Subject: Re: [IMail Forum] Account Harvesting >The way it is going to work in 8.2 is you will be able to set the >number off RCPT TO ERR's to allow during an SMTPD session before >dropping the connection. i.e with this setting at 5, IMail will drop >the connection after the 5 rcpt to error of the session.' Welcome, but insufficient, since most subscriber PCs don't send a lot of recips per session, and individual subscribers PCs don't typically bang on any one MX in great volume. It's a distributed DoS. The most typical situation is bogus recipients, one or a few per SMTP session, coming from 1000's of different IPS, predominantally subscriber access networks. The best defense is a separate MX front end with a list of legit recipients, so IMail sees only valid recipients. I don't think dictionary attacks/harvesting is the main activity, certainly not the harvesting part. It's just millions of infected PCs banging away, open loop, stupidly, at all our MXs. Perhaps the new 8.2 SMTPD will be less prone to being DoSed by large numbers of connections, and large numbers of unknown recips, but every IMail prior to 8.2 is vulnerable, which is, among other things, what drives many Imail admins to add IMGate as MX. Len _____________________________________________________________________ http://IMGate.MEIway.com : free anti-spam gateway, runs on 1000's of sites To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ ------------------------------ CompBiz.Net scanned for Virus' To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
