Why is it such a problem? Does it generated that much traffic? In my experience, there is no way of blocking these type of spam mail. In older mail servers, there was no CHKUSR function. So CHKUSR was developed specifically to eliminate this sort of spam coming into the server.
Regards, Riezal Ross -----Original Message----- From: Gabriel Lai Yong Shern [mailto:[EMAIL PROTECTED] Sent: Thursday, December 22, 2005 10:22 AM To: [email protected] Subject: Re: [qmailtoaster] Intrusion threshold Hmmmm, a problem for us... Now what I did was blocking their IP at firewall level, but this can't be a long solution, please advice more. Riezal Ross wrote: >Isn't that already blocked by CHKUSR? I get this daily and up to >thousands a month. If I am not mistaken there is a setting in >qmailtoaster on how many times the IP address can try to send to an >unknown recipient before it gets blocked. > >Regards, > >Riezal Ross > > >-----Original Message----- >From: Gabriel Lai Yong Shern [mailto:[EMAIL PROTECTED] >Sent: Thursday, December 22, 2005 10:13 AM >To: Qmail Toaster List 2 >Subject: [qmailtoaster] Intrusion threshold > > >Hi all, > >This morning I monitor my smtp current log file, and I found the below >messages: > >@4000000043aa0a8f179617f4 CHKUSER rejected intrusion: from ><[EMAIL PROTECTED]::> remote <ylnmr.gov:unknown:60.48.188.125> rcpt ><[EMAIL PROTECTED]> : rcpt ignored, session over INTRUSION threshold >@4000000043aa0a9704e5a3a4 CHKUSER rejected intrusion: from ><[EMAIL PROTECTED]::> remote <ylnmr.gov:unknown:60.48.188.125> rcpt ><[EMAIL PROTECTED]> : rcpt ignored, session over INTRUSION >threshold >@4000000043aa0a9c291090cc tcpserver: status: 8/100 >@4000000043aa0a9c2910a454 tcpserver: pid 11825 from 210.187.93.133 >@4000000043aa0a9c2910d71c tcpserver: ok 11825 >main.etech.net.my:191.167.10.251:25 :210.187.93.133::2560 >@4000000043aa0a9f0400ae5c CHKUSER rejected intrusion: from ><[EMAIL PROTECTED]::> remote <ylnmr.gov:unknown:60.48.188.125> rcpt ><[EMAIL PROTECTED]> : rcpt ignored, session over INTRUSION threshold >@4000000043aa0aaa104fc9f4 CHKUSER rejected intrusion: from ><[EMAIL PROTECTED]::> remote <ylnmr.gov:unknown:60.48.188.125> rcpt ><[EMAIL PROTECTED]> : rcpt ignored, session over INTRUSION >threshold @4000000043aa0aae021184a4 tcpserver: end 11809 status 0 >@4000000043aa0aae0211982c tcpserver: status: 7/100 >@4000000043aa0aba08587b74 CHKUSER rejected intrusion: from ><[EMAIL PROTECTED]::> remote <ylnmr.gov:unknown:60.48.188.125> rcpt ><[EMAIL PROTECTED]> : rcpt ignored, session over INTRUSION >threshold @4000000043aa0ac3014f9c04 CHKUSER rejected intrusion: from ><[EMAIL PROTECTED]::> remote <ylnmr.gov:unknown:60.48.188.125> rcpt ><[EMAIL PROTECTED]> : rcpt ignored, session over INTRUSION >threshold >@4000000043aa0acc2a0acb64 CHKUSER rejected intrusion: from ><[EMAIL PROTECTED]::> remote <ylnmr.gov:unknown:60.48.188.125> rcpt ><[EMAIL PROTECTED]> : rcpt ignored, session over INTRUSION threshold >@4000000043aa0ad621e2a114 CHKUSER rejected intrusion: from ><[EMAIL PROTECTED]::> remote <ylnmr.gov:unknown:60.48.188.125> rcpt ><[EMAIL PROTECTED]> : rcpt ignored, session over INTRUSION threshold >@4000000043aa0ae02fb6be9c CHKUSER rejected intrusion: from ><[EMAIL PROTECTED]::> remote <ylnmr.gov:unknown:60.48.188.125> rcpt ><[EMAIL PROTECTED]> : rcpt ignored, session over INTRUSION >threshold @4000000043aa0ae10be883ec CHKUSER accepted rcpt: from ><[EMAIL PROTECTED]::> remote ><mailgate.mbfcards.com:unknown:210.187.93.133> rcpt ><[EMAIL PROTECTED]> : found existing recipient >@4000000043aa0aeb15d2d484 CHKUSER rejected intrusion: from ><[EMAIL PROTECTED]::> remote <ylnmr.gov:unknown:60.48.188.125> rcpt ><[EMAIL PROTECTED]> : rcpt ignored, session over INTRUSION >threshold >@4000000043aa0af219647724 tcpserver: end 11825 status 0 >@4000000043aa0af219648aac tcpserver: status: 6/100 >@4000000043aa0af7164b7f24 CHKUSER rejected intrusion: from ><[EMAIL PROTECTED]::> remote <ylnmr.gov:unknown:60.48.188.125> rcpt ><[EMAIL PROTECTED]> : rcpt ignored, session over INTRUSION >threshold >@4000000043aa0b0508264014 CHKUSER rejected intrusion: from ><[EMAIL PROTECTED]::> remote <ylnmr.gov:unknown:60.48.188.125> rcpt ><[EMAIL PROTECTED]> : rcpt ignored, session over INTRUSION threshold >@4000000043aa0b111f1b5f0c CHKUSER rejected intrusion: from ><[EMAIL PROTECTED]::> remote <ylnmr.gov:unknown:60.48.188.125> rcpt ><[EMAIL PROTECTED]> : rcpt ignored, session over INTRUSION threshold >@4000000043aa0b1c2fb05dcc tcpserver: end 11801 status 0 >@4000000043aa0b1c2fb07154 tcpserver: status: 5/100 > > >Please advice how can I block all this..... > >Gabriel > > >--------------------------------------------------------------------- >To unsubscribe, e-mail: [EMAIL PROTECTED] >For additional commands, e-mail: >[EMAIL PROTECTED] > > > >--------------------------------------------------------------------- >To unsubscribe, e-mail: [EMAIL PROTECTED] >For additional commands, e-mail: >[EMAIL PROTECTED] > > > > > > --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
