When a spammer uses his botnet of thousands of zombie PCs to spam at random nonexistent addresses @example.com, at a very high rate of speed, postfix exhausts our VPS provider's resource limits trying to deal with it. Specifically, it exhausts the number of non-TCP sockets, which is limited to 900 by the VPS. Am running postfix 2.3.3-2.1.el5_2 on CentOS 5 on a Virtuozzo linux VPS.
/var/log/maillog says:
Feb 23 06:26:22 postfix/smtpd[3938]: warning: connect #1 to subsystem private/proxymap: Cannot allocate memory
Feb 23 06:26:22 postfix/smtpd[3936]: fatal: socket: Cannot allocate memory
Feb 23 06:26:48 postfix/qmgr[17702]: fatal: socket: Cannot allocate memory
Firewalling would be kind of tough because of the thousands of IPs involved in the dictionary attack.
The VPS provider suggested tuning the following parameters, but did not give suggestions on what to set them to:
max_idle = 100s (default)
max_use = 100 (default)
I found another person having the same problem with postfix and spammer dictionary attacks:
http://forums.vpslink.com/linux/394-you-hitting-socket-resource-limits-2.html#post5241
He changed:
default_process_limit from 100 (default) to 10
... which solved the problem but introduced a performance penalty.
I am unsure exactly which parameter should be safely tuned here, even after skimming postfix.org/TUNING%5FREADME.html Can any postfix expert help?