[exim] Re: smtp_accept_max & DDoS

2023-05-13 Thread Cyborg via Exim-users
Am 12.05.23 um 17:23 schrieb Slavko via Exim-users: Dňa 12. mája 2023 14:36:23 UTC používateľ Jeremy Harris via Exim-users napísal: Your short setting for smtp_receive_timeout is probably the best way (despite violating standards). IMO that standars violating is not true, RFC 6409 allows sho

[exim] Re: smtp_accept_max & DDoS

2023-05-13 Thread Andrew C Aitchison via Exim-users
7On Sat, 13 May 2023, Cyborg via Exim-users wrote: It's easy to detect if someone if blocking your exim: Loop over : 1. Getting all ID-Tripples netstat -lnap | grep exim | grep HERE>   | awk '{print $5":"$7;}' | sed -e "s/\/exim//g" 87.123.20.215:36858:1127858 87.123.20.215:36834:1127839 87

[exim] Re: smtp_accept_max & DDoS

2023-05-13 Thread Cyborg via Exim-users
Am 13.05.23 um 11:41 schrieb Andrew C Aitchison: I suggest to choose your timeout for the kill wisely, as some servers send a big chunk of data slow as hell, but a reasonable amount would be 30s. In addition, the netstat output could give out, if any data is in the connection buffer as an ind

[exim] Re: smtp_accept_max & DDoS

2023-05-13 Thread Slavko via Exim-users
Dňa 13. mája 2023 8:50:26 UTC používateľ Cyborg via Exim-users napísal: >I suggest to choose your timeout for the kill wisely, as some servers send a >big chunk of data slow as hell, but a reasonable amount would be 30s. As i have separate MSA, would not be more easy to setup that timeout righ

[exim] Re: smtp_accept_max & DDoS

2023-05-13 Thread Andrew C Aitchison via Exim-users
On Sat, 13 May 2023, Slavko via Exim-users wrote: Dňa 13. mája 2023 8:50:26 UTC používateľ Cyborg via Exim-users napísal: I suggest to choose your timeout for the kill wisely, as some servers send a big chunk of data slow as hell, but a reasonable amount would be 30s. As i have separate M

[exim] Re: smtp_accept_max & DDoS

2023-05-13 Thread Slavko via Exim-users
Dňa 12. mája 2023 14:36:23 UTC používateľ Jeremy Harris via Exim-users napísal: >Indeed, with the dovecot authenticator and that version of Exim >I don't think there's anything special you can do if you can't >fingerprint these connections in some way. I did simplifíed adaption of python doveco

[exim] Re: smtp_accept_max & DDoS

2023-05-13 Thread Jeremy Harris via Exim-users
On 13/05/2023 12:55, Andrew C Aitchison via Exim-users wrote: I would still like to know where the delay is actually happening; currently I guess it is somewhere in the authentication. No, the client has tried an auth command which we responded "fail" to, and then the client abandoned the TCP c

[exim] Re: smtp_accept_max & DDoS

2023-05-13 Thread Slavko via Exim-users
Dňa 13. mája 2023 11:55:36 UTC používateľ Andrew C Aitchison via Exim-users napísal: >I don't think we can do the kill from within exim. But is that needed? When timeout happens, socket is closed and process ends. >We may be able to get exim to fork a process that waits and then kills the >st

[exim] Re: smtp_accept_max & DDoS

2023-05-13 Thread Lena--- via Exim-users
Please create DNS records instead of CNAME: lists.exim.org. 300 IN MX 10 lists.exim.org. lists.exim.org. 300 IN A 37.120.190.30 Or accept emails to lists sent to . Else some people trying to post to lists get "unknown user" because sendmail "canonicalises" hostnames. > From: Andrew C Aitchison

[exim] Re: smtp_accept_max & DDoS

2023-05-13 Thread Jeremy Harris via Exim-users
On 13/05/2023 14:03, Jeremy Harris via Exim-users wrote: We could - manipulate the SMTP command timeout, as you suggest It turns out to be not much code to add an ACL control which modifies the timeout. Would that be of use for this case, and is it worth the feature-creep? The docs entry goes

[exim] Re: failure to transfer data from subprocess

2023-05-13 Thread Robert Nicholson via Exim-users
Here is some feedback I received from support for the host I’m using. I’m not quite sure I follow the significant of what they are pointing out and also it doesn’t look like I have the ability to debug exim myself The claim below is that it’s my pipe to the perlscript that causes the issues. Su

[exim] Re: smtp_accept_max & DDoS

2023-05-13 Thread Slavko via Exim-users
Dňa 13. mája 2023 18:01:43 UTC používateľ Jeremy Harris via Exim-users napísal: >On 13/05/2023 14:03, Jeremy Harris via Exim-users wrote: >> We could >> - manipulate the SMTP command timeout, as you suggest > >It turns out to be not much code to add an ACL control >which modifies the timeout. Wo

[exim] Re: failure to transfer data from subprocess

2023-05-13 Thread Jeremy Harris via Exim-users
On 13/05/2023 19:51, Robert Nicholson via Exim-users wrote: 02:19:39 13517 writing filter log as euid 1043 That tells us it came after handling a "logwrite" in a filter file... 02:19:39 13517 ╭considering: $header_from: 02:19:39 13517 ├──expanding: $header_from: 02:19:39 13517 ╰─re

[exim] Re: smtp_accept_max & DDoS

2023-05-13 Thread Jeremy Harris via Exim-users
On 13/05/2023 20:24, Slavko via Exim-users wrote: Or can this control be set from failed auth event named ACL? Yes. -- Cheers, Jeremy -- ## subscription configuration (requires account): ## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/ ## unsubscribe (doesn't r

[exim] Re: smtp_accept_max & DDoS

2023-05-13 Thread Slavko via Exim-users
Dňa 13. mája 2023 19:59:24 UTC používateľ Jeremy Harris via Exim-users napísal: >On 13/05/2023 20:24, Slavko via Exim-users wrote: >> Or can this control be set from failed auth event >> named ACL? >Yes. nice ;-) -- Slavko https://www.slavino.sk/ -- ## subscription configuration (requires

[exim] Re: failure to transfer data from subprocess

2023-05-13 Thread Robert Nicholson via Exim-users
Another thing I don’t quite understand with this is my .forward has something like this before the pipe save $home/Maildir/.INBOX.intray.backup/ this is catch all to save all mail. However when I see these errors with the SIGSEGV it’s as if the above step never completed either. The one chara

[exim] Re: failure to transfer data from subprocess

2023-05-13 Thread Jeremy Harris via Exim-users
On 13/05/2023 21:42, Robert Nicholson via Exim-users wrote: Another thing I don’t quite understand with this is my .forward has something like this before the pipe save $home/Maildir/.INBOX.intray.backup/ this is catch all to save all mail. However when I see these errors with the SIGSEGV it’