Thanks, But what if they are from different IP or I don't even get aware of the attack?
I think the best approach would be to use fail2ban. So I need someone that already has a rule Thanks On 29 July 2011 16:16, Sergio Rosa <[email protected]> wrote: > block them at the fw level. or place an iptables rules on your host. This > will do the job if the source ip is the same all the time. > > --- > Thank you, > Sérgio Rosa > > T. +351 91348 9195 > @. [email protected] > > AWD - Arq. Web e Design, Unip. Lda > R. Moinho Velho, 19, 2ºDto > 2655-242 Ericeira > http://www.awd.pt > > > On Fri, 29 Jul 2011 16:10:08 +0200, Délsio Cabá wrote: > >> Hi, >> >> I see these logs on pop3: >> @400000004e32be9f2581381c tcpserver: ok 19434 >> ns.mozdesigners.com:196.46.2.**236:110 :203.200.117.65::3912 >> @400000004e32bea00e2281e4 tcpserver: end 19433 status 256 >> @400000004e32bea00e22f32c tcpserver: status: 3/200 >> @400000004e32bea020c630ac tcpserver: end 19434 status 256 >> @400000004e32bea020c63c64 tcpserver: status: 2/200 >> @400000004e32bea11ed14264 tcpserver: status: 3/200 >> @400000004e32bea11ed15204 tcpserver: pid 19449 from 203.200.117.65 >> @400000004e32bea11edeb7b4 tcpserver: ok 19449 >> ns.mozdesigners.com:196.46.2.**236:110 :203.200.117.65::3970 >> @400000004e32bea21499cfb4 tcpserver: end 19449 status 256 >> @400000004e32bea21499df54 tcpserver: status: 2/200 >> @400000004e32bea312f84ce4 tcpserver: status: 3/200 >> @400000004e32bea312f8589c tcpserver: pid 19456 from 203.200.117.65 >> @400000004e32bea312f86454 tcpserver: ok 19456 >> ns.mozdesigners.com:196.46.2.**236:110 :203.200.117.65::4024 >> @400000004e32bea409545fd4 tcpserver: end 19456 status 256 >> @400000004e32bea409546f74 tcpserver: status: 2/200 >> @400000004e32bea5084443ac tcpserver: status: 3/200 >> @400000004e32bea50844534c tcpserver: pid 19462 from 203.200.117.65 >> @400000004e32bea508445f04 tcpserver: ok 19462 >> ns.mozdesigners.com:196.46.2.**236:110 :203.200.117.65::4092 >> >> It seams to be a dos. >> For smtp I use fail2ban. >> Anyone knows how to block these IP using by creating a rule on >> fail2ban? >> >> Regards >> > > > ------------------------------**------------------------------** > --------------------- > Qmailtoaster is sponsored by Vickers Consulting Group ( > www.vickersconsulting.com) > Vickers Consulting Group offers Qmailtoaster support and installations. > If you need professional help with your setup, contact them today! > ------------------------------**------------------------------** > --------------------- > Please visit qmailtoaster.com for the latest news, updates, and > packages. > To unsubscribe, e-mail: qmailtoaster-list-unsubscribe@** > qmailtoaster.com <[email protected]> > For additional commands, e-mail: qmailtoaster-list-help@** > qmailtoaster.com <[email protected]> > > >
