DOS attack on my mail server

[tnerurkar]

Hi all,

I got a DOS attack on my mail server. 100 mails came with the someid@mydomain.com. (mydomain.com is my mail server name). How can I prevent this for next time?

I am using sendmail-8.12.8-9.80 version.

Thanks in advance.

Regards
Tushar

 

[sedj]

Edit your /etc/mail/access file, and add in a line such as this :

cyberspammer.com 550 We don't accept mail from spammers

Then rebuild your access.db file :

makemap hash /etc/mail/access.db < /etc/mail/access

See this link :

http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/sendmail.html

--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[tnerurkar]

Hi,

Thanks for the reply.

I configured as per your instruction but it is rejecting messages of authorised users also. I m got following message for authorised user.

>>> RCPT To:<tushar@mydomain.com>
<<< 550 5.0.0 <tushar@mydomain.com>... We don't accept mail from spammers
550 5.1.1 <tushar@mydomain.com>... User unknown

Please help.

Regards
Tushar

 

[sedj]

Ahh, so you want to normally allow mail from whatever.com domain, but block joe@whatever.com ?

You must have a line like :

joe@whatever.com 550 Sorry Joe but no mail from you

Which will allow all other users at that domain to send mail, but not Joe.


--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[tnerurkar]

nope.
I want to allow only authorised user to be send mails. rest should be blocked.

I m getting mails to a@whatever.com, b@whatever.com, c@whatever.com, d@whatever.com which is not my authorised users. I want to block them. IDs are not specific. I think it is generic.

Please help.

Regards
Tushar

 

[sedj]

Well you didn't say that at first !

IN your access file :

# accept these users
a@whatever.com RELAY
b@whatever.com RELAY
c@whatever.com RELAY
d@whatever.com RELAY

#Reject all others for this domain
whatever.com REJECT Not authorized user

It is important to have the accepted users above the rejected domain.

--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[RicardoPereira]

I'am having the same issue (DOS attack).
I put my authnticated users on my access file, but now i have an relay denied everytime when the user gets a message

I have in my access file this:

mydomain.com REJECT
to:myuser1@mydomain.com RELAY
to:myuser2@mydomain.com RELAY
to:myuser3@mydomain.com RELAY
to:myuser4@mydomain.com RELAY

Do i need to do something else ?

Thanks