High CPU load, RCPT TO:

[Mike Kercher]

Marcel Blenkers wrote:
> Hi there,
>
> the method to block or stop mails to unknown recipients seems to be
> fine.
> But the last day i just made tail -f on my maillog, and noticed, that
> someone is sending a lot mails to postmaster within seconds.
>
> So, the accout postmaster is existing, but it seems to me that this
> person tried to get my maschine into its knees..
>
> is there a way to block someone sending a lot of  mails within a few
> seconds automaticaly?
>
> As these mails where no spam, just mails with some weird content,
> vispan did not work, as these mails where not tagged as spam.
>
> So i am wondering if there is a way to have a script looking into the
> logfile, and if one ip is sending max-mails within x seconds, add
> this ip to he access-file as blocked..
>
> Any ideas would be great
>
> Thanks
>
> Marcel

You might also tinker with the ConnectionRateThrottle parameter

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!