Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2226

Re: Keeping sendmail pest at bay

Show all headers | View raw

On Wed, 26 Jun 2013 12:03:55, Clark Smith <noaddress@nowhere.net> wrote:
>         Some clown is connecting to my sendmail server every few minutes, 
> eliciting the following traces in my /var/log/maillog file:

> Jun 26 09:54:37 my_box sm-mta[18410]: r5PIcehn018410: [xxx.xxx.xxx.xxx] 
> did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA

>         I have tried to drop packets from the offending IP address 
> (represented as xxx.xxx.xxx.xxx here) with 

>         iptables -I INPUT -s xxx.xxx.xxx.xxx -j DROP
>         iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP
>         iptables -A INPUT -s xxx.xxx.xxx.xxx -p tcp --destination-port 25 
> -j DROP

> in succession, but none of these rules are achieving anything - i.e. the 
> diagnostic above keeps appearing in my /var/log/maillog.

>         Any ideas on how to proceed?

The first command puts the rule at the beginning of the INPUT rules,
but you didn't specify -p tcp, so I'm not sure it was effective.
The next two puts the rule at the end of the INPUT rules.  Is there
an earlier rule which would accept the attempt?  Is there another
chain which accepts input requests?

I suggest that you try it again with the third rule format but
changed to -I, then look at all of your rules to see if there is
an early rule or another chain which accepts.

  # iptables -nvL --line-numbers

Use this command before and after the addition to see where it is.

Also watch the counts.  If the added rule is not being used,
the count on that rule will remain at zero.

-- 
Dale Dellutri <ddelQQQlutr@panQQQix.com> (lose the Q's)

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Keeping sendmail pest at bay Clark Smith <noaddress@nowhere.net> - 2013-06-26 16:03 +0000
  Re: Keeping sendmail pest at bay Richard Kettlewell <rjk@greenend.org.uk> - 2013-06-27 13:29 +0100
    Re: Keeping sendmail pest at bay Clark Smith <noaddress@nowhere.net> - 2013-06-27 13:26 +0000
  Re: Keeping sendmail pest at bay Dale Dellutri <ddelQQQlutr@panQQQix.com> - 2013-06-27 14:33 +0000
    Re: Keeping sendmail pest at bay Richard Kettlewell <rjk@greenend.org.uk> - 2013-06-27 15:40 +0100

csiph-web