Re: [exim] Dictionary attack protection

Top Page
Delete this message
Reply to this message
Author: Jakob Hirsch
Date:  
To: Gururajan Ramachandran, 'Exim-users'
Subject: Re: [exim] Dictionary attack protection
Quoting Gururajan Ramachandran:

>   drop condition = ${if >{$rcpt_fail_count}{3}{1}{0}}
>      message = Too many bad recipients.
> Even though I have greater than three as the trigger,
> the message is printed on the fifth email address
> everytime. Should it not be printed on the fourth
> email address everytime? Am I doing something wrong?


read spec.txt:

> $rcpt_fail_count
>
>     When a message is being received by SMTP, this variable contains the number
>     of RCPT commands in the current message that have previously been rejected
>     with a permanent (5xx) response.


So, after 4 failed recipients, when testing the 5th recipient, your
check is triggered (whether the 5th would have been rejected or not, btw).