Re: [Mimedefang] Somewhat OT: Dictionary attacks

2004-06-09 Thread David F. Skoll
On Wed, 9 Jun 2004, Brett Simpson wrote: > The script ran with one error where "Possible" was used instead of an IP > address. Doh. Fixed version follows. Regards, David. #!/bin/sh # # $Id: watch-dictionary-attacks,v 1.3 2004/06/09 17:09:24 dfs Exp $ # # Run this from cron every 5-10 minutes.

Re: [Mimedefang] Somewhat OT: Dictionary attacks

2004-06-09 Thread Brett Simpson
On Wednesday 09 June 2004 12:23 pm, Ben Kamen wrote: > How many bad recipients is acceptable? I have my throttling set at 2. I'm throttling at 2 also. > David F. Skoll wrote: > > Hi, > > > > Are MIMEDefang list denizens seen a huge increase in dictionary attacks? > > I know I am. > > > > Below is

Re: [Mimedefang] Somewhat OT: Dictionary attacks

2004-06-09 Thread Ben Kamen
Which brings up another thought: That of using such gathered output to generate another DNSBL of some sort. ;) How many bad recipients is acceptable? I have my throttling set at 2. -Ben David F. Skoll wrote: Hi, Are MIMEDefang list denizens seen a huge increase in dictionary attacks? I know I am.

Re: [Mimedefang] Somewhat OT: Dictionary attacks

2004-06-09 Thread Ben Kamen
I have and I am also running something like that - I wrote a TCL script that does exactly what you're talking about... It's features are: routes IP's into the 'route add -blackhole' almost immediately. Runs continuously based on tcl's fileevent (as to not suck CPU time) Keeps a table in /tm

[Mimedefang] Somewhat OT: Dictionary attacks

2004-06-09 Thread David F. Skoll
Hi, Are MIMEDefang list denizens seen a huge increase in dictionary attacks? I know I am. Below is a shell script I run from cron every 5 minutes to firewall off hosts doing harvesting. It's Linux-specific, but can easily be adapted for other systems. Regards, David. #!/bin/sh # # $Id: watch-