On 11/15/2013 08:58 AM, LHTek wrote:
Hello all,
I have this intermittent issue...
I host many clients and every once in a while one of my users will get a
virus and start spewing out spam emails. I came in this morning and
found one had sent over 3000 in just an hour. I have scripts in place
that alert me about this so I'm able to catch it but I want to catch it
sooner - perhaps auto-stop it.
NOTE: These are authenticated users who's email programs have been
hi-jacked and are sending with valid logins.
My setup is QmailToaster Plus, SpamDyke, SpamAssassin, Fail2Ban, ClamV
- all with the latest versions.
I am curious about how other admins handle this situation? Surely I'm
not the only one being bitten by this.
Let me know if this question is better suited for the SpamDyke list - I
don't mean to waste band-width.
Thanks in advance,
Denny
This is entirely appropriate to discuss here. Perhaps more so than the
spamdyke list, as I think this is a little outside of spamdyke's ability
to deal with. Although there are some very bright people on that list as
well, so you might want to ask this there as well. :)
The best solution I've seen to this particular problem is something that
the gmane.org news gateway does. It simply throttles outgoing messages,
limiting the rate at which it sends messages for each user.
I hope to one day come up with a patch to qmail-remote which does this.
I wrote a program spec recently for this, and will be happy to share it
with anyone who'd like to do a little C programming to implement it.
--
-Eric 'shubes'
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
