High CPU load, RCPT TO:

[Dirk Enrique Seiffert]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> What makes you thing sendmail is looping? All the usernames are
> different.... Looks like a standard rumplestiltskin attack to me, where a
> spammer is just trying every name in a dictionary on your domain to see if
> they can discover new email addresses by brute-force. Most of us are
> sustaining these on a frequent basis now days, although generally in a
> distributed fashion instead of single source.

I get lots of them, no idea why it has to be me: Its a simple mailserver for a
small domain. We are relaying to maybe 1500 mails per day, not more. Since a
few weeks these attacks started, I get them every few minutes.
>
> If this is bogging down your CPU, perhaps you need to check into doing
> something to make username lookup lighter weight than it is (are you using
> milter-ahead or something of the sort?)
Nothing like that: Users are local unix users.

>
> You might also want to look at things like rumplekill
>
> http://bignosebird.com/notebook/rumplekill.shtml

This looks good and straightforward: I installed already, will let you know if
it helps.

Thanks a lot

Enrique

>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

--
Dirk Enrique Seiffert
CaribeNet S.A. - Cartagena - Colombia
www.caribenet.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!