On Thu, Mar 13, 2008 at 10:41:59AM -0700, Paul Johnson wrote: > On Thursday 13 March 2008 09:49:27 am will trillich wrote: > > hey debianistas, long time no chat! debian cruises along rock solid so > > nicely... :) > > You're always welcome to pipe up when you see a topic you know about, > too. :o) > > > but recently we're seeing a TON of these -- > > > > 2008-03-13 10:32:36 Connection from [67.55.80.182] refused: too many > > connections 2008-03-13 10:32:37 Connection from [75.146.102.69] refused: > > too many connections > > 2008-03-13 10:32:37 Connection from [201.34.170.231] refused: too many > > connections > > 2008-03-13 10:32:38 Connection from [92.49.136.189] refused: too many > > connectionsroot > > > > and there's NEVER a moment where we don't have 25+ connections active. > > this is for a small office in town, so my guess is that most of this > > traffic is unsolicited. we're using VEXIM so the config is nonstandard > > -- for greylisting we had to 'greylistd-setup-exim4 add exim4.conf > > acl_check_rcpt') > > > > anybody here come up with a clever approach on how to handle this? > > Are you already using greylisting? If not, the easiest way to set this up is > to install the greylistd package and follow the easy instructions > in /usr/share/doc/greylistd. The whole process should take download time+5 > minutes. are these IP's successfully sending mail? and to whom? I've you're getting that amount of traffic it's possible you're relaying and don't realise it. How does the mailq look? also, fail2ban's later versions (sid at least) include support for exim and it will install cleanly on etch. A
Attachment:
signature.asc
Description: Digital signature