RE: [exim] exim allowed someone to slam my mail server for 3…

On Mon, 27 Jun 2005, Mark Smith wrote:

>
> > I just added this and I tested it from a yahoo account by
> > sending to 4 addresses on my domain, 3 of which are bogus.
> >
> > Yahoo makes 4 connections:
> >
> > 10800 Listening...
> > 10800 Connection request from 68.142.206.160 port 43138 10800
> > 1 SMTP accept process running 10800 Listening...
> > 10800 Connection request from 68.142.206.160 port 43139 10800
> > 2 SMTP accept processes running 10800 Listening...
> > 10800 Connection request from 68.142.206.160 port 43140 10800
> > 3 SMTP accept processes running 10800 Listening...
> > 10800 Connection request from 68.142.206.160 port 43141 10800
> > 4 SMTP accept processes running 10800 Listening...
> >
> > So, that's disappointing. The spammer has to cooperate?
> >
> > Marilyn Davis
> >
> The only way to deal with that is to set smtp_accept_max_per_host = 1.

Thank you. But it doesn't seem to fix anything, it just takes longer
because the other connections are delayed. But the result is the
same. $rcpt_count never gets above 1.

Now, why would yahoo only send one RCPT per connection when 4
addresses to the same domain are on the same message? What is the
benefit of doing that -- aside from facilitating spam from their
addresses?

Marilyn

>
> - Mark
>
>

--