High CPU load, RCPT TO:

[Denis Beauchemin]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Marcel Blenkers wrote:

>Hi there,
>
>the method to block or stop mails to unknown recipients seems to be fine.
>But the last day i just made tail -f on my maillog, and noticed, that
>someone is sending a lot mails to postmaster within seconds.
>
>So, the accout postmaster is existing, but it seems to me that this person
>tried to get my maschine into its knees..
>
>is there a way to block someone sending a lot of  mails within a few
>seconds automaticaly?
>
>As these mails where no spam, just mails with some weird content, vispan
>did not work, as these mails where not tagged as spam.
>
>So i am wondering if there is a way to have a script looking into the
>logfile, and if one ip is sending max-mails within x seconds, add this ip
>to he access-file as blocked..
>
>  
>

Marcel,

MailScanner offers IPBlock in CustomConfig.pm.  It does pretty much what 
you want (as long as you use sendmail).  I have been using it here for 
almost a year with success.

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, "S/MIME Cryptographic Signature"  ]
    [ Application/X-PKCS7-SIGNATURE  4.4KB. ]
    [ Unable to print this part. ]