Re: Stopping "machine gunners" - not really a

Jochen Bern has written patch to sendmail which implements a maximum 
"mail from:" limit.

I've played with it a bit in testing and it definitely works, though 
I've only used it in a test environment so I can't  vouch for its use 
in production.  FWIW reading the provided Revision History gives the 
sense that Jochen is working closely with the sendmail community and 
that the patch may be included as a feature in future release.

Here's the URL:
http://www.informatik.uni-trier.de/~bern/sendmail/Patch-bm/

I'd be curious to know about your results if you put this into your 
production environment.

Brian Ross
IT Engineer, Sr. - Messaging Services
Postmaster - QUALCOMM, Inc.



At 06:26 AM 3/13/2006, Dennis Wynne wrote:
> >I think you want something like Sendmail 8.13.x's ratecontrol and
> >conncontrol throttle options.
>
>
>I had one of these options set, but added the other one - thanks.
>
>We had a spammer hit last week with nearly 200 messages in just a few
>minutes, greylist temp failed all of them and only 2 went through. The
>brevity of the attack made me wonder why the connection parameters did not
>block more of them. Turns out the spammer did not disconnect in between
>e-mails - just connected up and let fly.
>
>I Googled about this problem and it appears to be a weak spot in sendmail -
>no  way to limit messages per connection.  Looks like I will need a milter
>to do this or maybe something like this patch:
>
>http://www.informatik.uni-trier.de/~bern/sendmail/Patch-bm/
>
>
>Did I miss something (again) in the sendmail setup - or is there no way to
>limit messages per connection?
>
>Thanks,
>Dennis
>
>
>
>_______________________________________________
>Greylist-users mailing list
>[email protected]
>http://lists.puremagic.com/cgi-bin/mailman/listinfo/greylist-users