Is there anything that can be done in Imail to block or stop dictionary attacks?
what kind of volume/hour?
Since a dictionary attack will be almost totally to non-existent recipients, SMTPD will reject them after RCPT TO:, with the smallest possible bandwidth lost, before the DATA command and bulk of the bandwidth exposure.
That "should" be very efficient, but I know from rescuing Imail servers (that couldn't keep with large numbers of mail to unknown recipients) by placing IMGate out front, Imail seems to spend a fatally large amount of resources rejecting unknown recipients. When that level is reached, Imail basically shuts down and stops sending/receiving any msgs.
I had several in a row this morning that totally consumed our bandwidth ...
It would be nice if Imail had someway to detect this type of attack, log the IP and refuse connections from it for a set period of time.
If the attack was really from a manageably small number of IPs, that approach would be quite simple, and even simpler if Imail's access control files were plain text instead of a proprietary binary format.
As an alternative, you could write a short script, under 10 lines, using unix tools for Windows I've mentioned here several times, that would update a packet filter rules text file used by PktFilter, which is used by many Imail admins for "host security". by blocking at the TCP level, Imail wouldn't see any SMTP connections, which is exactly what you want. Having Imail block access at the SMTP level is probably not effectively more lightweight than Imail rejecting unknown recipients.
But in my recent experience, msgs to unknown recipients more commonly, ie, like 24 x 7 x 365 at EVEVRY MX that I admin, comes from wide range of IPs, therefore impossible to harvest+block at any level. In that case (well, in all cases), the best is having a front-end MX do the rejecting.
Len
_____________________________________________________________________ http://IMGate.MEIway.com : free anti-spam gateway, runs on 1000's of sites
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
