[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: postfix, spamassassin and spam ~ blocking cable and adsl modems

On Sat, 7 Aug 2004 09:52, Steven Jones <thing@katrina.thing.dyndns.org> wrote:
> We seem to be, being hit with in excess of 12,000 spam emails per day
> from adsl and cable modems in the US alone. Then we get brute force
> attacked....the server at times gets somewhat stretched...
> What would ppl suggest it the most efficient way to block such
> addresses?

If you use some DNSBL services you can block access from dial-up and broadband 
customer IP addresses without blocking mail servers.  Below is the list of 
DNSBL and RHSBL services that I have one one of my machines.

smtpd_client_restrictions = permit_mynetworks, 
reject_rbl_clientbl.spamcop.net, reject_rbl_client dnsbl.sorbs.net, 
reject_rbl_client list.dsbl.org, reject_rbl_client cbl.abuseat.org, 
reject_rbl_client dnsbl.njabl.org, reject_rbl_client sbl.spamhaus.org, 
reject_rbl_client relays.ordb.org, reject_rhsbl_client rhsbl.sorbs.net, 
reject_rhsbl_client dsn.rfc-ignorant.org, reject_rhsbl_client 

> The goal here is to minimise disk i/o as that is the item being
> stretched, iostat -x 5 shows over 450% utilisation.....delays are geting
> to 4+ hours...and they bitch if its over 5 minutes....

Putting some of that iostat output as a text attachment to your email would 
really help us advise you about this (NB don't paste it into your email as 
the lines are too long and will get munged).

> I have 4 cpu's and spare capacity on these and I am only using 2.5 gig
> out of 4gig of ram so have spare here....the box only processes incoming
> smtp only, outgoing takes another route.....

The spare RAM will be cache, so most likely your machine is doing few disk 
reads and it's entirely bottlenecked on disk writes when it's running.

If you mount all your file systems with the noatime option then you may save 
5% or 10% of your disk access.

Configure syslogd to use the "-" option for most (if not all) log files to not 
use synchronous writes.  Every email gets several lines in the syslog and you 
don't want them to all be written synchronously.

> At present I am running ext3 on the logging and spool directories but
> considering reiserFS, a good idea?
> Also I am aiming to get more disks as I ahve only 2, so I can either
> raid 0 over the 3 new disks or split the queues....to 3 disks, which
> might be better?

Don't use RAID-0, it increases the probability of data loss through disk 
error.  A hardware RAID-5 over the 5 disks will give better write performance 
if you have a battery-backed write-back cache on the RAID controller (the 
cheap ones don't).

> Would a scsi hwraid based cache controller be worth it?


If you mount your Ext3 file systems with "data=journal" and have external 
journals on a separate disk then you may get really good performance.

Usually the lower block numbers of a disk are mapped to the outer tracks and 
have a higher data transfer rate (use the zcav program in my Bonnie++ package 
to test this).  So you could have the main file systems for storing the data 
on one pair of disks in a RAID-1 array and the external journals for those 
file systems on the fastest part of another pair of disks in a separate 
RAID-1.  If you have a pair of disks used for nothing but journals (which 
will probably take <100M of disk space) then the seeks should all be very 
short which will give a fast access time.


An even better option might be to use non-volatile RAM storage devices.  Above 
is the URL for a company that makes PCI cards that have non-volatile storage.  
These cards can handle reads and writes at PCI bandwidth (four times faster 
than any hard disk even with 32bit PCI) and with no seek time (hard disks can 
only do about 100 seeks a second while the umem cards should do 50,000 or 
more depending on the size of the data blocks).

I don't know whether the Linux drivers for umem cards work with the latest 
hardware, you would have to check with them.

Also umem cards aren't particularly expensive.  Last time I got a quote the 
high-end cards were only about $700US.

http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

Reply to: