Randy Ramsdell wrote:
Wietse Venema wrote:
I added the following entry to the wip.html file on the Postfix website.
Wietse
Trickle attack defense
The postscreen daemon, available with Postfix 2.8 and later, already
implements time limits to receive one complete SMTP command line.
Postscreen uses a default time limit of 300s for RFC compliance,
but it will switch to a 10s limit under overload conditions.
Postscreen never receives mail, so this is a complete solution.
The rest of Postfix still uses per-read time limits, instead of
per-line time limits. Support for per-line time limits is currently
tested in Postfix 2.9. This solves most of the problem; it limits
the time to receive one complete SMTP command line, but it does
not yet limit the total amount of time to receive the content of
an email message. Instead, use the existing spam blocking mechanisms
to reject mail before the SMTP "DATA" command.
300s for each line as in: mail from: blah ---> 300s?
What I am getting at here is that the attack will still succeed if using
it for DOS. I am not trying trivialize this work, but understand how
this will stop an attack vs. increase the time before the system is
fully hosed.
rcr
