On 03/06/2023 17:48, Julian Bradfield via Exim-users wrote:
Having switched on acl debugging at the 70th denied RCPT, what I see
in the logs is:
check delay = 5s
delay modifier requests 5-second delay
delay cancelled by peer close
As far as I can see, this only makes any sense if the attacker has
closed its input stream (exim's output stream) - but then shouldn't
exim get an error when it sends the response?
Yes. But you didn't show us that bit.
And why would the
attacker close its input stream so it can't see the response?
Because it doesn't really care? It can just pipeline all the
RCPT TO: lines, fire-and-forget.
--
Cheers,
Jeremy
--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscr...@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
