On Sat, August 25, 2012 7:37 pm, Reindl Harald wrote: > Am 25.08.2012 07:09, schrieb li...@sbt.net.au:
> most likely an attack > there is no need to get notified because you can rate-control > anvil_rate_time_unit = 1800s smtpd_client_connection_rate_limi = 50 Reindl, thanks how do I monitor to see if it 'kicked in' and from whom ? (sorry, hit 'send too quick) is it a 'good idea' to firewall block such when they're from unresolvable host like this ? Host 50.112.115.27.in-addr.arpa. not found: 3(NXDOMAIN) # grep "max connection rate" /var/log/maillog Aug 26 03:45:43 geko postfix/anvil[19189]: statistics: max connection rate 28/1800s for (smtp:27.115.112.50) at Aug 26 03:40:49 ... Aug 26 04:35:43 geko postfix/anvil[19189]: statistics: max connection rate 22/1800s for (smtp:27.115.112.50) at Aug 26 04:35:12 Aug 26 04:45:43 geko postfix/anvil[19189]: statistics: max connection rate 28/1800s for (smtp:27.115.112.50) at Aug 26 04:41:50
