Author: Randy Bush Date: To: exim users Subject: [exim] detecting overly frequent smtp from real user
had a legit user user with weak password. someone cracked it and used
it to drive a lot of spam by smtping in with plain auth.
anyone have scripting to raise alerts if there is inbound smtp from a
legit user above some threshold?
i will also likely remove all user passwords from /etc/passwd (as shell
access is ssh key only anyway) and put passwords for legit smtpers into
`server_condition` in `authenticators`
