re; stopping spam attacks

"Jon Miller" <[email protected]>
Newsgroups gmane.linux.redhat.release.enigma
Message-ID <[email protected]>
I would like to know how to prevent this sort of mail bombing from happening:
May 21 00:47:16 rhfs1 postfix/smtp[12132]: connect to mx3.compuserve.com[149.174.40.5]: Connection refused (port 25)
May 21 00:47:17 rhfs1 postfix/smtp[12132]: connect to mx3.compuserve.com[149.174.40.6]: Connection refused (port 25)
May 21 00:47:17 rhfs1 postfix/smtp[12151]: BF5DF14AB8E: to=<[email protected]>, relay=mailin-04.mx.aol.com[64.12.138.152], delay=5, status=sent (250 OK)
May 21 00:47:17 rhfs1 postfix/smtp[12132]: connect to mx1.compuserve.com[149.174.40.4]: Connection refused (port 25)
May 21 00:47:17 rhfs1 postfix/smtp[12110]: connect to mx1.mail.lycos.com[209.202.220.135]: Connection timed out (port 25)
May 21 00:47:17 rhfs1 postfix/smtp[12132]: connect to mx1.compuserve.com[149.174.40.134]: Connection refused (port 25)
May 21 00:47:18 rhfs1 postfix/smtpd[12244]: connect from rhfs1[192.168.1.10]
May 21 00:47:18 rhfs1 postfix/smtpd[12244]: 42D8E14AB8E: client=rhfs1[192.168.1.10]
May 21 00:47:18 rhfs1 postfix/cleanup[12245]: 42D8E14AB8E: message-id=<[email protected]>
May 21 00:47:18 rhfs1 postfix/nqmgr[11365]: 42D8E14AB8E: from=<[email protected]>, size=2422, nrcpt=1 (queue active)
May 21 00:49:42 rhfs1 postfix/nqmgr[11365]: F316E14ABE6: from=<>, size=4166, nrcpt=1 (queue active)
May 21 00:49:46 rhfs1 postfix/smtp[12110]: F316E14ABE6: to=<[email protected]>, relay=mx1.mail.yahoo.com[64.156.215.6], delay=5, status=bounced (host mx1.mail.yahoo.com[64.156.215.6] said: 553 VS10-RT Possible forgery or deactivated due to abuse (#5.1.1))
May 21 00:49:47 rhfs1 postfix/smtp[12153]: 0841D14ABE4: to=<[email protected]>, relay=pbimailc.prodigy.net[207.115.63.107], delay=10, status=bounced (host pbimailc.prodigy.net[207.115.63.107] said: 553 5.3.0 DNSBL:You are listed at relays.osirusoft.com)
May 21 00:49:47 rhfs1 postfix/cleanup[12245]: 71A9714ABE5: message-id=<[email protected]>
May 21 00:49:47 rhfs1 postfix/nqmgr[11365]: 71A9714ABE5: from=<>, size=4147, nrcpt=1 (queue active)
May 21 00:49:48 rhfs1 postfix/smtp[12132]: 71A9714ABE5: to=<[email protected]>, relay=mx2.mail.yahoo.com[64.157.4.78], delay=1, status=bounced (host mx2.mail.yahoo.com[64.157.4.78] said: 553 VS10-RT Possible forgery or deactivated due to abuse (#5.1.1))
May 21 00:49:49 rhfs1 postfix/smtp[12136]: DCA7C14ABDD: to=<[email protected]>, relay=mx1.compuserve.com[149.174.40.4], delay=88, status=sent (250 2.0.0 h4KGsvhV000740 Message accepted for delivery)

Currently using rhl7.3 with postfix-1.1.7-2.
This is a printout of the port scan I did on the server using nmap

(The 1534 ports scanned but not shown below are in state: closed)
Port       State       Service
22/tcp     open        ssh
25/tcp     open        smtp
53/tcp     open        domain
110/tcp    open        pop-3
6000/tcp   filtered    X11                <- would like to not see these ports below as "filtered ports".  Perfer not to see them at all.
12345/tcp  filtered    NetBus          <- Is this possible?
12346/tcp  filtered    NetBus
31337/tcp  filtered    Elite


/etc/postfix/master.cf (sniped)

# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (50)
# ==========================================================================
#smtp   inet    n       -       y       -       -       smtpd
2500    inet    n       -       n       -       -       smtpd  <- used for Sophos MailMonitor


Thanks

Jon L. Miller, MCNE, CNS
Director/Sr Systems Consultant
MMT Networks Pty Ltd
http://www.mmtnetworks.com.au

"I don't know the key to success, but the key to failure
 is trying to please everybody." -Bill Cosby
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.