I'd like to set up a way to tarpit spammers that connect to my mail server - I have set up fail2ban to run a iptables tarpit, and it seems to be working. The question is, how can I disconnect the postfix smtpd process to free up those resources while still holding the spammer tarpitted?
|
feedback
|
|
not exactly trapitting, but you might want to look at greylisting - there are some solutions for postfix. personally i'm not found at all of that method [since people expect mail to work in near-real-time], but one thing for sure - it is quite efficient in cutting off unwanted spam. | |||
feedback
|
|
Do you send packets to the tarpit as soon as you detect a spammer ? If you cannot find a way to kill the specific process handling that connection, maybe you can let the current connection finish ? It should be possible to setup iptables so that whenever a packet matches your host blacklist, it first checks if it is part of an existing connection (if so let it pass), otherwise send it to NOTRACK & TARPIT ? | |||
|
feedback
|
|
This may not help you right now, but Postfix 2.8 is slated to get the postscreen service, which is a single pre-smtpd screening process that does some basic checks before passing the connection on. Depending on how fast you're identifying the connections as tarpittable, you may be able to catch them before they get to smtpd. To get this right now, you'd have to run the experimental release or extract the postscreen binary from it and try to integrate it into your current setup (possibly difficult). For now, you could look into sort of inverting the iptables action that fail2ban does so that Postfix gets an RST packet and frees up the smtpd. | |||
|
feedback
|
