How do we block mail bombs?

Hi all,

some time ago I heard a fellow narrating about his having been mail bombed with 
so many messages per hour that he had to set his server to answer 421 to all 
message while he was cleaning up the affected mailboxes.

I wondered what would I've done in that case.  Failure to react promptly would 
result in filling out the mailboxes, if not the whole disk.

A better way would be to deploy some kind of ratefilter.  A possibility is to 
use iptables' hashlimit on port 25, which, however, doesn't count multiple 
messages per connection.  Or is it worth developing a mail-oriented filter?

A very desirable feature would be to tell usual correspondents from newcomers, 
so as to prioritize the ones, in case of mailbombing, and block the others. 
But how does a global filter learn which is which?

Or should one use maildrop, so as to distinguish which user's folders or 
extensions are being targeted?

Thoughts?


Best
Ale
-- 






_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users