With Exim you can ratelimit. Used to have the same problem tell I did this.
http://www.exim.org/exim-html-current/doc/html/spec_html/ch40.html#SECTratelimiting # This limits each IP to 1000 recipients in 12 hour period warn ratelimit = 1000 / 12h / per_rcpt / strict delay = 20s log_message = Sender $sender_address rate $sender_rate / $sender_rate_period excedes limit delayed 20 seconds You can also do this with Mikrotik in limited way. It only counts TCP connections. http://wiki.mikrotik.com/wiki/How_to_autodetect_infected_or_spammer_users_and_temporary_block_the_SMTP_output Matt On Fri, Jun 26, 2009 at 10:33 AM, Marlon K. Schafer <[email protected]>wrote: > Hi All, > > What are you guys doing for email these days? I LOVE my setup for it's > reliability, ease of use etc. > > Hacked customer accounts and virus's are killing me though. We don't catch > things until 100,000s of messages go out and we get black listed. This has > now happened 3 or 4 times in the last couple of years. > > My server admins aren't coming up with a solution to this other than to > limit cc's to 25 per message. We did that once before and my phone rang > off > the hook because people can't send jokes to their friends..... > > The other thing that makes it hard is that the log files that I get (up to > 40 megs per day!) don't list the authenticated sender, only the reply > address. So I see tens of thousands of messages from a user that's not > even > mine (faked info). sigh > > We use Courier MTA. > > My thought is to set the server to allow a max of 1000 messages per day per > user. And to somehow make the log file ONLY send me the number of messages > received per a user, and the number sent, user name and ip addy of all > those > sending. Twice now I've asked about that idea and gotten no response from > the server admins. > > Suggestions? > > laters, > marlon > > -------------------------------------------------------------------------------- WISPA Wants You! Join today! http://signup.wispa.org/ -------------------------------------------------------------------------------- WISPA Wireless List: [email protected] Subscribe/Unsubscribe: http://lists.wispa.org/mailman/listinfo/wireless Archives: http://lists.wispa.org/pipermail/wireless/
