SMTP Attacks

[Jeff Kinz]

On Tue, Oct 24, 2006 at 11:46:52AM -0700, Harold Hallikainen wrote:
> I might mess around with another copy of the sshblack script and have it
> watch the mail logs and block IP addresses that appear to be attacking the
> server. I already have a copy watching the ssh log and another watching
> the httpd log.
> 
> THANKS!
> 
> Harold

Hi Harold,

How many addresses are you blocking?  I have heard that iptables will
begin to slow the system down a lot once you exceed 500 blocked
addresses.

Are you running into any problems with this?

Jeff Kinz



-- 
This e-mail was created using Dragon's NaturallySpeaking.  There may be
errors, omissions, or additions present.  Of course none of that keeps
the author from making stupid mistakes as well.