You might try using the -b flag with rblsmtpd, this will send 553 error code
(permanent) instead of 451 (temporary)..
--Adam
On Sat, Jun 05, 1999 at 10:49:26PM -0500, [EMAIL PROTECTED] wrote:
> I'm getting LOTS of ORBS hits suddenly, like this:
>
> Jun 5 22:41:00 gw smtpd: 928640460.637397 rblsmtpd: pid 4196: 451 See
>http://www.orbs.org/blocked.cgi. Your mailserver is in the ORBS database as an
>insecure email relay. This is a generic text message.
> Jun 5 22:41:02 gw smtpd: 928640462.642219 rblsmtpd: pid 4198: 451 See
>http://www.orbs.org/blocked.cgi. Your mailserver is in the ORBS database as an
>insecure email relay. This is a generic text message.
> Jun 5 22:41:03 gw smtpd: 928640463.555417 rblsmtpd: pid 4199: 451 See
>http://www.orbs.org/blocked.cgi. Your mailserver is in the ORBS database as an
>insecure email relay. This is a generic text message.
> Jun 5 22:41:04 gw smtpd: 928640464.110713 rblsmtpd: pid 4200: 451 See
>http://www.orbs.org/blocked.cgi. Your mailserver is in the ORBS database as an
>insecure email relay. This is a generic text message.
>
> Every second or two, on for hours. Normal mail traffic seems to be
> working okay. I upgraded ezmlm+idx today, and I applied the
> qmail-verh patch, so I *could* have knocked something over; but the
> ORBS hits at least have been going on all day in the log-file (must
> have been going yesterday too, they start immediately on log rollover
> today), well before I touched any software, so I don't *think* I
> caused this problem myself.
>
> The frequency is too low to be a deliberate DOS attack, I'd think --
> one connect every second or so, while it's making the logs grow, isn't
> really hurting me, and looks more like persistence than malice.
> Unfortunately rblsmtpd fails to log anything useful; it just gives the
> TXT record from ORBS, and ORBS has chosen not to have them say
> anything meaningful / useful. What I want, of course, is the IP
> address the connect was from. Has anybody patched rblsmtpd to log
> that already? It looks darned easy -- except that I don't speak Dan's
> non-stdio library. I'll probably tackle it eventually anyway if
> nobody has done the deed.
>
> Am I overlooking some other reasonable way to find out where this is
> coming from easily?
> --
> David Dyer-Bennet [EMAIL PROTECTED]
> http://www.ddb.com/~ddb (photos, sf) Minicon: http://www.mnstf.org/minicon
> http://ouroboros.demesne.com/ The Ouroboros Bookworms
> Join the 20th century before it's too late!
