I've inherited a botnet target
in [Postfix]
|
From: Ansgar Wiechers on 26 May 2010 15:24 On 2010-05-26 Ralf Hildebrandt wrote: > Shouldn'T you use at least ONE RBL? Probably wouldn't hurt, but unless he's trying to fight off spam sent to valid users (which according to his description doesn't seem to be the case) he could go without as well. Regards Ansgar Wiechers -- "Abstractions save us time working, but they don't save us time learning." --Joel Spolsky
From: brian on 26 May 2010 15:26 On 10-05-26 03:03 PM, Ralf Hildebrandt wrote: > * brian<postfix-list(a)logi.ca>: > > Which domain is the old one, which is the new one? "One change I suggested was to utilise a .org domain rather than .com" > Shouldn'T you use at least ONE RBL? > E.g.: > > smtpd_recipient_restrictions = > permit_mynetworks, > reject_unauth_destination > reject_rbl_client zen.spamhaus.org > > I apologise for not mentioning RBL. What I'm looking for is some way to drop these attempts at the earliest possible time. The server doesn't have lots of RAM (not my decision) so I've found postfix going into stress mode as it is. Also, the logs are piling up very quickly.
From: brian on 26 May 2010 15:29 On 10-05-26 03:21 PM, Ansgar Wiechers wrote: > > The connections are being rejected, so unless your server resources are > being exhausted by the delivery attempts I don't think you have to worry > about it. As mentioned in another msg, I neglected to mention that postfix is already being put into stress mode. Sadly, the client didn't want to spring for a VPS with more RAM. Of course, if this keeps up, I'll be sure to mention it again.
From: Matt Hayes on 26 May 2010 15:31 On 5/26/2010 3:29 PM, brian wrote: > On 10-05-26 03:21 PM, Ansgar Wiechers wrote: >> >> The connections are being rejected, so unless your server resources are >> being exhausted by the delivery attempts I don't think you have to worry >> about it. > > As mentioned in another msg, I neglected to mention that postfix is > already being put into stress mode. Sadly, the client didn't want to > spring for a VPS with more RAM. Of course, if this keeps up, I'll be > sure to mention it again. > > I wonder if using something like postscreen from the 2.8-snapshots would help to curtail some of the resource usage. -Matt
From: Ansgar Wiechers on 26 May 2010 15:33
On 2010-05-26 brian wrote: > On 10-05-26 03:21 PM, Ansgar Wiechers wrote: >> The connections are being rejected, so unless your server resources >> are being exhausted by the delivery attempts I don't think you have >> to worry about it. > > As mentioned in another msg, I neglected to mention that postfix is > already being put into stress mode. Sadly, the client didn't want to > spring for a VPS with more RAM. Of course, if this keeps up, I'll be > sure to mention it again. In that case I'd say iptables/fail2ban is the way to go (until you get to upgrade the hardware). Regards Ansgar Wiechers -- "Abstractions save us time working, but they don't save us time learning." --Joel Spolsky |