Spammers causing problems

[brett]

Hello all,

My server has recently been the target of attempts to spam using our MTA. Even though we're not set up as an open relay, these connections aren't stopping, and it's starting to seriously affect performance. About three times a day, I have to go in to manually restart processes that have been killed by the kernel because of out of memory errors.

I've slimmed down the MTA as much as I could by removing hooks to anti-spam and anti-virus programs, but it's not helping. I've also temporarily blocked entire class B subnets that were attacking my server, but I can't keep up with it. I obviously can't just disable email until the attacks are over, but I'm at a loss as to what to do...Any suggestions?

Brett

[yellowfruit]

Two possibilities that come to mind:

Firstly, there are sites online that keep lists of IPs that spammers commonly use that you could plug into the firewall and drop packets on entry.

Second, if its an option you could move the ports of your servers. You may have seen on the forums comments about large amounts of connection attempts via SSH. I moved my SSH server to another port number and all attempts stoped entirely.

[brett]

Thanks for the tips. I'm already blocking by 4 different RBLs, and it's not helping too much. This wouldn't help the problem much anyway because they're trying to use My server as their email server...

If I changed the port of my MTA, I wouldn't be able to receive and email from legitimate hosts...

I managed to slow it some by blocking all of Asia using iptables, but this probably isn't the best solution.

For the interested, the ports for "Asia" are below:
58.0.0.0/7
60.0.0.0/7
124.0.0.0/7
126.0.0.0/8
169.208.0.0/12
196.192.0.0/13
202.0.0.0/7
210.0.0.0/7
218.0.0.0/7
220.0.0.0/7
222.0.0.0/8

Brett

[matta]

Is there perhaps an add-on script for your MTA to detect 10+ failed relay attempts and in event of that add an iptables drop rule?

[werpon]

You can rate-limit connection attempts to your server using iptables. See this mini HOWTO (http://www.debian-administration.org/articles/187) for an example.

[brett]

Thanks for the tips...

The rate limiting howto was very interesting...

Brett