[exim] Re: Excessive "bad recipient" messages in syslog

2023-05-29 Thread Cyborg via Exim-users
Hi, Am 28.05.23 um 23:32 schrieb Jeremy Harris via Exim-users: Or you could consider an escalating delay, every time you detect the condition. Can you point on a good example for such a tearpit , I thought about using those on servers that have nothing else to do, just to troll the attacker

[exim] Tackling Bot Blasts

2023-05-29 Thread Pete Long via Exim-users
Hi all, As I’m sure many of you have witnessed, there appears to be something of a concerted effort recently amongst bot-herders to test (completely free of charge) our Internet connections and servers by smashing them with hundreds of delivery attempts per second. Per second. I cannot recall

[exim] Re: Tackling Bot Blasts

2023-05-29 Thread Odhiambo Washington via Exim-users
On Mon, May 29, 2023 at 4:23 PM Pete Long via Exim-users < exim-users@lists.exim.org> wrote: > Hi all, > > As I’m sure many of you have witnessed, there appears to be something of a > concerted effort recently amongst bot-herders to test (completely free of > charge) our Internet connections and s

[exim] Re: Tackling Bot Blasts

2023-05-29 Thread Slavko via Exim-users
Dňa 29. mája 2023 9:01:56 UTC používateľ Pete Long via Exim-users napísal: >drop > message = No host name found. > condition = ${if eq{$host_lookup_failed} {1} {1}{0}} Beware, host lookup is done by forward confirmation, in other words, PTR followed by A/ lookup. That variable has 1 if

[exim] Re: Tackling Bot Blasts

2023-05-29 Thread Markus Reschke via Exim-users
Hi Slavko! On Mon, 29 May 2023, Slavko via Exim-users wrote:A Anyway, that must be enough: condition = $host_lookup_failed or: !verify = reverse_host_lookup ciao Markus -- / Markus Reschke \ \ madi...@theca-tabellaria.de / -- ## subscription configuration (requires acc

[exim] Re: Tackling Bot Blasts

2023-05-29 Thread Pete Long via Exim-users
On 2023-05-29 18:36:18, Odhiambo Washington wrote: > On Mon, May 29, 2023 at 4:23 PM Pete Long via Exim-users < > exim-users@lists.exim.org> wrote: > > > acl_check_rcpt: > > > > drop > >message = No host name found. > >condition = ${if eq{$host_lookup_failed} {1} {1}{0}} > > > > How about

[exim] Re: Tackling Bot Blasts

2023-05-29 Thread Ian Z via Exim-users
On Mon, May 29, 2023 at 10:01:56AM +0100, Pete Long via Exim-users wrote: > After trying several ACLs and even inviting IPTables to the party at > one stage, I still seemed powerless to prevent mainlog filling up > with an inordinate amount of crap; that is until this morning. Once I tried iptabl

[exim] Re: Tackling Bot Blasts

2023-05-29 Thread Pete Long via Exim-users
On 2023-05-29 16:24:36, Slavko via Exim-users wrote: > Dňa 29. mája 2023 9:01:56 UTC používateľ Pete Long via Exim-users > napísal: > > >drop > > message = No host name found. > > condition = ${if eq{$host_lookup_failed} {1} {1}{0}} > > Beware, host lookup is done by forward confirmation, >

[exim] Re: Tackling Bot Blasts

2023-05-29 Thread Pete Long via Exim-users
On 2023-05-29 10:34:14, Ian Z via Exim-users wrote: > On Mon, May 29, 2023 at 10:01:56AM +0100, Pete Long via Exim-users wrote: > > > After trying several ACLs and even inviting IPTables to the party at > > one stage, I still seemed powerless to prevent mainlog filling up > > with an inordinate am