Re: Flood blocking

2009-06-07 Thread Tim
Tim: >> That depends on the list. Some will automatically suspend you for one >> or two failures. Ed Greshko: > I don't see a problem since the type of block being proposed would not > result in an SMTP 5XX permanent error. It would simply result in a > requeue of the email on the sending sid

Re: Flood blocking

2009-06-07 Thread Bruno Wolff III
On Sun, Jun 07, 2009 at 07:15:58 -0700, "Wolfgang S. Rupprecht" wrote: > > I think you have to decide if such a thing is a good idea by asking > yourself what would happen if a larger percentage of the recipients did > this. And if the mailing list were large, the server would be asked to > do

Re: Flood blocking

2009-06-07 Thread Wolfgang S. Rupprecht
Ed Greshko writes: > I don't see a problem since the type of block being proposed would not > result in an SMTP 5XX permanent error. It would simply result in a > requeue of the email on the sending side in much the same way as the > server being down on the receiving side or a network error bet

Re: Flood blocking

2009-06-07 Thread Ed Greshko
Tim wrote: > On Sat, 2009-06-06 at 17:32 -0600, Ashley M. Kirchner wrote: > >> And even if it's a temporary block, say lasting 5 minutes, that >> shouldn't adversely affect mailing lists, I don't think. >> > > That depends on the list. Some will automatically suspend you for one > or two f

Re: Flood blocking

2009-06-07 Thread Tim
On Sat, 2009-06-06 at 17:32 -0600, Ashley M. Kirchner wrote: > And even if it's a temporary block, say lasting 5 minutes, that > shouldn't adversely affect mailing lists, I don't think. That depends on the list. Some will automatically suspend you for one or two failures. -- [...@localhost ~]$

Re: Flood blocking

2009-06-06 Thread Ashley M. Kirchner
Bruno Wolff III wrote: That depends on what mailing lists you are on. Some can send a lot of email. I don't think you are going to find much antispam success trying to block this way. The few lists we're subscribed to, I don't see this happening. Even with Fedora's list, I don't see a lot of

Re: Flood blocking

2009-06-06 Thread Kevin O'Neil
On Fri, 2009-06-05 at 22:29 -0600, Ashley M. Kirchner wrote: > I currently have one system I'm testing the following rules on: > > iptables -N SSHSCAN > iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j SSHSCAN > iptables -A SSHSCAN -m recent --set --name SSH > iptables -

Re: Flood blocking

2009-06-06 Thread Bruno Wolff III
On Fri, Jun 05, 2009 at 22:29:32 -0600, "Ashley M. Kirchner" wrote: > >I currently have one system I'm testing the following rules on: > >iptables -N SSHSCAN >iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j SSHSCAN >iptables -A SSHSCAN -m recent --set --name SSH >

Re: Flood blocking

2009-06-06 Thread Mike Wright
Ashley M. Kirchner wrote: I currently have one system I'm testing the following rules on: iptables -N SSHSCAN iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j SSHSCAN iptables -A SSHSCAN -m recent --set --name SSH iptables -A SSHSCAN -m recent --update --seconds 300 --

Flood blocking

2009-06-05 Thread Ashley M. Kirchner
I currently have one system I'm testing the following rules on: iptables -N SSHSCAN iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j SSHSCAN iptables -A SSHSCAN -m recent --set --name SSH iptables -A SSHSCAN -m recent --update --seconds 300 --hitcount 2 --name SSH -j D