Hello all,
I am making an attempt at discouraging dictionary attacks (and I see many)
but there is some point of failure, which has left me stumped.
In RCPT acl, I have these rules:
# Deny, blacklist and teergrube if too many incorrect/bad recipients as that
# is a likely sign of a dictionary attack.
deny message = Max $rcpt_fail_count failed recipients allowed
condition = ${if > {${eval:$rcpt_fail_count}}{2}{yes}{no}}
condition = ${run{/usr/local/etc/exim/dictscan.pl $sender_host_address}{1}{1}}
delay = ${eval: ($rcpt_fail_count) * 30}s
log_message = Dictionary scan! $rcpt_fail_count failed recipient attempts
# If they added themselves to the file above, let's block them for Dict Scan!!!
deny message = REGRET_TEXT
hosts = /usr/local/etc/exim/dictscan.ips
delay = 150s
I use the attached script, which when tested in the CLI, gives
wash@ns2 ('tty') ~ 407 -> perl /usr/local/etc/exim/dictscan.pl 1.2.3.3
wash@ns2 ('tty') ~ 408 -> cat /usr/local/etc/exim/dictscan.ips
# Tue Sep 9 13:20:45 2003
1.2.3.3
In the logs I see this:
2003-09-09 13:09:03 H=(printerserver) [61.152.210.131] F=<umzu3mdy@???> \
rejected RCPT <muchene@???>: Dictionary scan! 3 failed recipient attempts
The part that leaves me stumped is why the script does not run!
When I run a debug test with one of the ips I get from the log, I see that the
rule is working, it even goes ahead to effect the delay, but never does it
put the offending IP in the file.
Of course the delay works so well, all I would like to find out is why the
{run{... fails
Log snippet:
>>> => that means 80.240.192.5 is not listed at orbs.dorkslayers.com
>>> warn: condition test failed
>>> processing "deny"
>>> check condition = ${if > {${eval:$rcpt_fail_count}}{2}{yes}{no}}
>>> = yes
>>> check condition = ${run{/usr/local/etc/exim/dictscan.pl $sender_host_address}{1}{1}}
>>> = 1
>>> check delay = ${eval: ($rcpt_fail_count) * 30}s
>>> = 90s
>>> delay modifier requests 90-second delay
Thanks
cheers
- wash
+----------------------------------+-----------------------------------------+
Odhiambo Washington . WANANCHI ONLINE LTD (Nairobi, KE) |
<wash at wananchi dot com> . 1ere Etage, Loita Hse, Loita St., |
GSM: (+254) 722 743 223 . # 10286, 00100 NAIROBI |
GSM: (+254) 733 744 121 . (+254) 020 313 985 - 9 |
+---------------------------------+------------------------------------------+
"Oh My God! They killed init! You Bastards!"
--from a /. post
