On Thursday, Jun 12, 2003, at 04:31 America/Los_Angeles, Ask Bjørn Hansen wrote:
Devin made a plugin ("check_earlytalker") that tries to detect those as the request is begin received:
http://xrl.us/jhb (Link to cvs.perl.org)
I just checked my logs for the last ~30 hours and it's rejecting quite a few mails. A cursory glance over the logs indicates that it's all at least suspicious connections (no reverse DNS and many IPs from China and Korea). It's hard to really tell when you disconnect them without looking at even their first EHLO. :-)
Rasjid's "count_unrecognized_commands" - http://xrl.us/jhc - plugin is also blocking a few connections here (it would probably be many more if I didn't also use the check_earlytalker plugin).
Thanks Rasjid & Devin!
All that being said, it would be interesting if you can get good results out of an "instant proxy checker" without killing the performance too much. One of the big points of qpsmtpd is exactly to make it easier to try out new things.
- ask
-- http://www.askbjoernhansen.com/
