Re: How to detect this kind of attacks

2016-11-26 Thread Walter Alejandro Iglesias
On Sat, Nov 26, 2016 at 12:18:23PM +0100, Gilles Chehade wrote: > There's not much you can do besides adding the offending addresses in a > pf blacklist. Yeah, that's what I thought (at least using opensmtpd, I guess what Claus quoted is from actual sendmail man page). Thanks to all for answerin

Re: How to detect this kind of attacks

2016-11-26 Thread Peter N. M. Hansteen
On 11/26/16 12:08, Walter Alejandro Iglesias wrote: > Is there a way to detect on the fly spam attacks like the pasted below > (maillog)? It seems pf max-src-conn-rate takes in care only the > "connected" event. > > I obscured the recipients. Basically sorted addresses of the same target > Chin

Re: How to detect this kind of attacks

2016-11-26 Thread Gilles Chehade
On Sat, Nov 26, 2016 at 12:08:37PM +0100, Walter Alejandro Iglesias wrote: > Hello everyone, > > Is there a way to detect on the fly spam attacks like the pasted below > (maillog)? It seems pf max-src-conn-rate takes in care only the > "connected" event. > There's not much you can do besides ad

Re: How to detect this kind of attacks (MTA: Invalid RCPT)

2016-11-26 Thread Claus Assmann
On Sat, Nov 26, 2016, Walter Alejandro Iglesias wrote: > Is there a way to detect on the fly spam attacks like the pasted below > (maillog)? It seems pf max-src-conn-rate takes in care only the Check the docs for your MTA. > Nov 26 05:59:46 server smtpd[55880]: 3bcc430eee258cd7 smtp > event=fa

How to detect this kind of attacks

2016-11-26 Thread Walter Alejandro Iglesias
Hello everyone, Is there a way to detect on the fly spam attacks like the pasted below (maillog)? It seems pf max-src-conn-rate takes in care only the "connected" event. I obscured the recipients. Basically sorted addresses of the same target Chinese host. Nov 26 05:59:42 server smtpd[55880]: