Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to set up a way to tarpit spammers that connect to my mail server - I have set up fail2ban to run a iptables tarpit, and it seems to be working. The question is, how can I disconnect the postfix smtpd process to free up those resources while still holding the spammer tarpitted?

share|improve this question

4 Answers 4

You might find these options interesting...

I really miss the 60s-or-so delay qmail added to every additional recipient/message if they exceeded say 10 messages...

Used these on main.cf

# limit max sends per minute
anvil_rate_time_unit = 60s
smtpd_client_event_limit_exceptions = $mynetworks
smtpd_client_recipient_rate_limit = 15
smtpd_client_message_rate_limit = 30

You might try to decrease these numbers, 15 and 30 are still somewhat big. Today I've been hit by two spammers, one using 90 and other using 183 distinct IP addresses. If each is sending at 15/minute, they send 4.095 emails a minute! Well that of course would be better than 100.000 a minute. :)

But if you set it too low, your customers will probably complain not being able to attach photos to their long customers list.

Qmail's tarpit just added delay between messages when they exceeded a threshold, what was fine no matter how many recipients where in the list. This could somehow be applied to postfix as well and you could safely limit the list as low as 5 recipients/messages per minute. :/

share|improve this answer

not exactly trapitting, but you might want to look at greylisting - there are some solutions for postfix.

personally i'm not found at all of that method [since people expect mail to work in near-real-time], but one thing for sure - it is quite efficient in cutting off unwanted spam.

share|improve this answer
    
I got that already. I just want to punish the stupid bot networks that hammer my server with repeated relay attempts. (attempts, as I do properly give a 5xx error for it) –  DGM Jul 20 '10 at 1:42

Do you send packets to the tarpit as soon as you detect a spammer ?

If you cannot find a way to kill the specific process handling that connection, maybe you can let the current connection finish ? It should be possible to setup iptables so that whenever a packet matches your host blacklist, it first checks if it is part of an existing connection (if so let it pass), otherwise send it to NOTRACK & TARPIT ?

share|improve this answer

This may not help you right now, but Postfix 2.8 is slated to get the postscreen service, which is a single pre-smtpd screening process that does some basic checks before passing the connection on. Depending on how fast you're identifying the connections as tarpittable, you may be able to catch them before they get to smtpd. To get this right now, you'd have to run the experimental release or extract the postscreen binary from it and try to integrate it into your current setup (possibly difficult).

For now, you could look into sort of inverting the iptables action that fail2ban does so that Postfix gets an RST packet and frees up the smtpd.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.