[resolved] Blocking Postfix Spam Bombs?

jlward4th · Tux's lil' helper Joined: 07 Jan 2003 Posts: 83

I've been getting hit by some crazy distributed spam bombs for a few days now. The attacks come from thousands of different hosts and try to phish for email addresses. Here is one rejected attempt:

eccerr0r · Posted: Wed Dec 19, 2007 6:05 pm Post subject:

You could just grep all those away, or disable mail completely? (obviously with the side effect of not receiving any more legitimate mail.)

Really no matter what you do, you'll still get some sort of connection from the spam source host. As soon as it reveals it's trying to send to a nonexistent address, then you get the log, then it will finally disconnect...
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

kashani · Posted: Wed Dec 19, 2007 6:26 pm Post subject:

It's more likely that someone has been using your domain as their from: address. What you're seeing is bounces from legitimate mail servers to the randomly generated from addresses at your domain. At least that's what I usually see under the same conditions. Unfortunately there is no decent way to deal with this.

kashani
_________________
Will personally fix your server in exchange for motorcycle related shop tools in good shape.

eccerr0r · Posted: Wed Dec 19, 2007 11:28 pm Post subject:

Sorry to have to say this but

"Welcome to the realities of the real world."

I get so much crap over the internet, all I can do is ignore them as much as I can. I get so much junk spam scatterbacks, ftp warez server searches, ssh attempts, phpbb spam posters, ugh...

The spam scatterbacks I can't do much about but eat them.
ssh attempts - if it's random, same thing, have to eat, else I do have something like fail2ban.
ftp searches - well i disabled ftpd, problem solved.
phpbb spam posters, well this one I hacked up a solution that has seemed to work - those OCR bots seem to now have some trouble decoding my captchas. No more spam registrations! woohoo!
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

linuxpyro · Apprentice Joined: 08 Sep 2004 Posts: 255

For spam, I've found greylisting to be very effective. Check it out on the wiki:
http://gentoo-wiki.com/HOWTO_Setup_a_Virtual_Postfix/Courier_Mail_System_with_PostfixAdmin#Sqlgrey

jlward4th · Tux's lil' helper Joined: 07 Jan 2003 Posts: 83

I've found a few things helpful in resolving this:

http://systembash.com/content/450-vs-550-smtp-errors/
http://en.wikipedia.org/wiki/Joe_job

And thanks to everyone who responded and helped me figure out better ways to resolve this.