fighting dictionary attacks?
Josh Trutwin <[email protected]>
| Newsgroups | gmane.comp.sysutils.bgware |
|---|---|
| Message-ID | <[email protected]> |
I have a nice setup with mailfront / qmail that implements real/good rcptto SMTP level rejection with the generous help from the experts on this list. It's greatly cut back on the amount of crap that goes through my scanners (AV/SA) that is destined to never be delivered anyway. The only problem is now a couple domains in particular are getting blasted with dictionary attacks. I'm curious if anyone has recommendations for fighting this or do you just put up with it? I'd like to block these a-holes right at the start of the SMTP conversation without attempting ANY delivery, even if they manage to have a single valid recipient in their message. For example, grepping through the logs shows me that [email protected] seems to be a popular attempt at a valid address, from various IP's. Are there any tools that would allow me to tell qmail to drop any SMTP conversation that contains a recipient of [email protected] (or whatever)? I guess what I'm most interested in is qmail/mailfront dishing out one "553 Go to Hell you SOB" vs. 100's (1000's!) of "553 Sorry, recipient address not valid". /var/log/qmail/smtpd> grep keinan * | grep -v <<list of valid addressed removed for privacy reasons>> | wc -l 15497 That particular domain is worst hit, but there are a few others... /var/log/qmail/smtpd> grep "553 Sorry, recipient address not valid" * | wc -l 18240 (that's grepping through only 2 day's worth of logs) Thx, Josh