[Exim] [patch] anti sorted dictionary attack

Top Page
Delete this message
Reply to this message
Author: Ollie Cook
Date:  
To: exim-users
Subject: [Exim] [patch] anti sorted dictionary attack
This patch may be useful to some sites. It enables you to detect sorted
dictionary attacks and take action as you see fit in ACLs.

e.g (in the DATA ACL):

  deny    message       = dictionary attack detected
          condition     = ${if and {                                   \
                                    {>{$rcpt_fail_count}{3}}           \
                                    {>{$recipients_lex_trend_num}{5}}  \
                                   }                                   \
                                   {yes}{no}}


The patch is available as a diff against Exim 4.30 from

http://www.olliecook.net/projects/eximpatches/exim-4.30-dictionary-attack.patch

Cheers,

Ollie

--
Oliver Cook    Systems Administrator, Claranet UK
ollie@???               +44 20 7903 3065