Re: [Exim] dictionary attack

Top Page
Delete this message
Reply to this message
Author: Giuliano Gavazzi
Date:  
To: Nico Erfurth, George Szekely
CC: exim-users
Subject: Re: [Exim] dictionary attack
At 0:50 +0100 2003/03/07, Nico Erfurth wrote:
[...]
>How about this?
>
>deny message   = Recipient unknown
>      !verify   = recipient
>      delay     = ${eval: ($rcpt_fail_count + 1) * 1}m

>


as was discussed some time ago, since the original poster is victim
of dictionary attacks, I would also deny any recipient after a
certain number of failures n:

condition = ${if > {${eval:$rcpt_fail_count}}{n}{yes}{no}}

Personally I would reject all recipients, also the one acceptedbefore
this condition was true, if any, by denying at the DATA phase. I
guess this is not needed once the delay is over 5 minutes...


Giuliano