----- Original Message ----- From: "David Dodell" <[EMAIL PROTECTED]> To: "Imail Mailing List" <[EMAIL PROTECTED]> Sent: Monday, July 12, 2004 06:56 Subject: [IMail Forum] Dictionary attacks ??
> Is there anything that can be done in Imail to block or stop > dictionary attacks? > > I had several in a row this morning that totally consumed our > bandwidth ... > > It would be nice if Imail had someway to detect this type of attack, > log the IP and refuse connections from it for a set period of time. We wrestled with this for a couple of months. It was getting so bad that IMail would become non-responsive during the worst attacks. We tried reading the logs to determine the worst offenders, then placing that list into the smtpd32.acc file, but the nature of the attacks meant pretty quick response, and it is simply not possible to shut down the SMTP server every five minutes. We even tried popping them into access lists on our gateway router, but the numbers were just so big that our router started to get bogged down. Finally, I grabbed an old 233mhz Pentium box, installed Linux and Postfix on it and obtained the IMGate config files. We use Declude for spam control, so I tossed out all the spam testing (RBLs, etc.) but left in the settings meant for dictionary attacks. The Postfix server sits between the Internet and our IMail box, and does cute things like slow down connections of potential attackers and kill any connection that gets more than three addresses wrong. To use this effectively, I wrote a script which dumps all the IMail box's addresses and aliases once an hour, so that the Postfix box can act upon hosts pushing through bad addresses without passing it on to the IMail box. It was a bit of a pain to set up, but it has taken the load off the IMail box. I think I'm going to have to move to a faster server though, as the 233 does get bogged down itself. At least our customers aren't getting "server not responding" errors trying to send mail, which was becoming a big problem when these attacks really got going during business hours. So, in short, IMGate/Postfix is a solution, though one that takes some effort to get going. -- A. Clausen [EMAIL PROTECTED] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
