Re: Spam protection by auto-blocking suspicious accounts

2014-01-06 Thread Julio Cesar Covolato
Em 06/01/2014 13:12, Roland Plüss escreveu: A couple of days ago my mail server got attacked by a spammer. As it looks like he managed to compromise the password of one of the users on the system and SASL authenticated using the account to send spam. I blocked the attacking IP and changed the pas

Re: Spam protection by auto-blocking suspicious accounts

2014-01-06 Thread postfix
On 1/6/2014 5:32 PM, Mike McGinn wrote: On Monday, January 06, 2014 10:12:38 Roland Plüss wrote: A couple of days ago my mail server got attacked by a spammer. As it looks like he managed to compromise the password of one of the users on the system and SASL authenticated using the account to sen

Re: Spam protection by auto-blocking suspicious accounts

2014-01-06 Thread li...@rhsoft.net
Am 06.01.2014 16:43, schrieb Roland Plüss: > > On 01/06/2014 04:32 PM, li...@rhsoft.net wrote: >> >> Am 06.01.2014 16:29, schrieb Robert Schetterer: >>> Am 06.01.2014 16:24, schrieb li...@rhsoft.net: Am 06.01.2014 16:12, schrieb Roland Plüss: > A couple of days ago my mail server got at

Re: Spam protection by auto-blocking suspicious accounts

2014-01-06 Thread Mike McGinn
On Monday, January 06, 2014 11:40:02 post...@pupat-ghestem.net wrote: > On 1/6/2014 5:32 PM, Mike McGinn wrote: > > On Monday, January 06, 2014 10:12:38 Roland Plüss wrote: > >> A couple of days ago my mail server got attacked by a spammer. As it > >> looks like he managed to compromise the passwo

Re: Spam protection by auto-blocking suspicious accounts

2014-01-06 Thread Robert Schetterer
Am 06.01.2014 17:40, schrieb post...@pupat-ghestem.net: > On 1/6/2014 5:32 PM, Mike McGinn wrote: >> On Monday, January 06, 2014 10:12:38 Roland Plüss wrote: >>> A couple of days ago my mail server got attacked by a spammer. As it >>> looks like he managed to compromise the password of one of the u

Re: Spam protection by auto-blocking suspicious accounts

2014-01-06 Thread Mike McGinn
On Monday, January 06, 2014 10:12:38 Roland Plüss wrote: > A couple of days ago my mail server got attacked by a spammer. As it > looks like he managed to compromise the password of one of the users on > the system and SASL authenticated using the account to send spam. I > blocked the attacking IP

Re: Spam protection by auto-blocking suspicious accounts

2014-01-06 Thread li...@rhsoft.net
Am 06.01.2014 16:12, schrieb Roland Plüss: > A couple of days ago my mail server got attacked by a spammer. As it > looks like he managed to compromise the password of one of the users on > the system and SASL authenticated using the account to send spam. I > blocked the attacking IP and changed th

Re: Spam protection by auto-blocking suspicious accounts

2014-01-06 Thread Roland Plüss
On 01/06/2014 04:32 PM, li...@rhsoft.net wrote: > > Am 06.01.2014 16:29, schrieb Robert Schetterer: >> Am 06.01.2014 16:24, schrieb li...@rhsoft.net: >>> Am 06.01.2014 16:12, schrieb Roland Plüss: A couple of days ago my mail server got attacked by a spammer. As it looks like he managed

Re: Spam protection by auto-blocking suspicious accounts

2014-01-06 Thread Roland Plüss
On 01/06/2014 04:32 PM, li...@rhsoft.net wrote: > > Am 06.01.2014 16:29, schrieb Robert Schetterer: >> Am 06.01.2014 16:24, schrieb li...@rhsoft.net: >>> Am 06.01.2014 16:12, schrieb Roland Plüss: A couple of days ago my mail server got attacked by a spammer. As it looks like he managed

Re: Spam protection by auto-blocking suspicious accounts

2014-01-06 Thread Robert Schetterer
Am 06.01.2014 16:32, schrieb li...@rhsoft.net: > correct, the problem itself can only be fixed manually in any case > but the difference between 400 or 40 messages by one spambot > makes the difference get blacklisted everywhere or not :-) you may blacklisted by only "one" spammail somewhere

Re: Spam protection by auto-blocking suspicious accounts

2014-01-06 Thread Robert Schetterer
Am 06.01.2014 16:24, schrieb li...@rhsoft.net: > Am 06.01.2014 16:12, schrieb Roland Plüss: >> A couple of days ago my mail server got attacked by a spammer. As it >> looks like he managed to compromise the password of one of the users on >> the system and SASL authenticated using the account to se

Re: Spam protection by auto-blocking suspicious accounts

2014-01-06 Thread li...@rhsoft.net
Am 06.01.2014 16:29, schrieb Robert Schetterer: > Am 06.01.2014 16:24, schrieb li...@rhsoft.net: >> Am 06.01.2014 16:12, schrieb Roland Plüss: >>> A couple of days ago my mail server got attacked by a spammer. As it >>> looks like he managed to compromise the password of one of the users on >>> t

Re: Spam protection by auto-blocking suspicious accounts

2014-01-06 Thread Robert Schetterer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Am 06.01.2014 16:12, schrieb Roland Plüss: > Now to deal with this situation in the future I would like to > automatically lock down an account if an unusual amount of mails > are sent like 60 per minute or so. you need an anomaly checker, so first yo