Our web server is currently undergoing a botnet attack on Exim.
Our server is CentOS and is setup with BFD (Brute Force detect that uses APF to prevent access) to detect attempts and block them. This setup works 99% of the time, however since Friday we have been under a distributed dictionary attack to gain access to email accounts.
I have adjusted BFD to trigger on a single "Incorrect authentication" in the mainlog in exim and BFD is running every 30 seconds, however they are still getting through.
So far over a thousand machines have been blacklisted with the period currently set to a 4 day ban.
Are there any other suggestions as to what can be done?