[OT] sendmail equivalent of zmailer's MaxSameIpSource ??

[Steen, Glenn]

I had a similar thing a couple of weeks back. Found out, in
MailWatch that the culprit never had any "legal" communication with us,
so I ended up blocking the IP in the FW.
Linux-2.2 == Kernel 2.2.x? ... Meaning ipchains? Been to long for me
to remember how:-).

-- Glenn

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of paddy
> Sent: den 30 december 2004 16:12
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: [OT] sendmail equivalent of zmailer's MaxSameIpSource ??
> 
> 
> On Thu, Dec 30, 2004 at 02:56:40PM +0000, Julian Field wrote:
> > Look in CustomConfig.pm for the IPBlock stuff. It's all 
> there, ready to
> > roll. There's even the associated cron job there for tidying up the
> > database.
> 
> Thanks Julian, but it's before that :(
> 
> These connections don't seem to progress beyond RCPT, so it's neither
> a mailscanner issue, nor something mailscanner can help with, 
> hence [OT].
> 
> I'm aware of MaxDaemonChildren and will be setting that anyway, but
> something along the lines of MaxSameIPsource would be really nice.
> I don't think I can even use a milter, this sendmail is too old.
> 
> So this is just a ping off the list
> 
> 1) In case I've missed an obvious way of doing this
> 2) to share the experience - I've not noticed this pattern before, and
> it is a potential nuisance and possibly spam or malware related.
> 
> Whatabout some more general OS level connection limiting, anyone?
> linux-2.2, can I squeeze this out of the firewalling or something ?
> 
> Regards,
> Paddy
> --
> Perl 6 will give you the big knob. -- Larry Wall
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!