Re: [vps-mail] Email dictionary attacks - what would you do?

[Scott Wiersdorf <scottw@xxxxxxxxxxxx>]

On Mon, Feb 28, 2005 at 12:35:42PM -0800, Ken Douglass wrote:
> Scott,
> Yes, daily fussing with the access list is wasting my time. 
> 
> So would you just wait it out, hoping it will stop by itself?

Yes. If you're server isn't adversely impacted, just let them flail
their puny fists against your "rock-solid FreeBSD VPS v2" :)

> When watching the logs, how would I know when I'm dropping legitimate mail?

You'll see a connection from a known source that doesn't finish. I
think just an occasional (several times daily) sending mail to
yourself would probably check this.

> I see a lot of "lost input channel from..."
> http://walnutdesign.com/bw.050227.lost_input.txt
> I think this means the other side gave up and closed the connection after
> getting my error back, without saying QUIT before going away. Does this mean
> my server sitting, waiting, and perhaps not available for other traffic?

No, that's a connecting client error as you thought. Not to worry
about it, afaik.

Scott
-- 
Scott Wiersdorf
scottw@xxxxxxxxxxxx
======================================================================
This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
Before posting a question, please search the archives (see above URL).