Path: csiph.com!newsfeed.hal-mli.net!feeder3.hal-mli.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!news.linkpendium.com!news.linkpendium.com!panix!not-for-mail From: Dale Dellutri Newsgroups: comp.os.linux.networking Subject: Re: Keeping sendmail pest at bay Date: Thu, 27 Jun 2013 14:33:56 +0000 (UTC) Organization: PANIX Public Access Internet and UNIX, NYC Lines: 39 Message-ID: References: NNTP-Posting-Host: panix1.panix.com X-Trace: reader2.panix.com 1372343636 3951 166.84.1.1 (27 Jun 2013 14:33:56 GMT) X-Complaints-To: abuse@panix.com NNTP-Posting-Date: Thu, 27 Jun 2013 14:33:56 +0000 (UTC) User-Agent: tin/2.0.0-20110823 ("Ardenistiel") (UNIX) (NetBSD/5.2 (i386)) Xref: csiph.com comp.os.linux.networking:2226 On Wed, 26 Jun 2013 12:03:55, Clark Smith wrote: > Some clown is connecting to my sendmail server every few minutes, > eliciting the following traces in my /var/log/maillog file: > Jun 26 09:54:37 my_box sm-mta[18410]: r5PIcehn018410: [xxx.xxx.xxx.xxx] > did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA > I have tried to drop packets from the offending IP address > (represented as xxx.xxx.xxx.xxx here) with > iptables -I INPUT -s xxx.xxx.xxx.xxx -j DROP > iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP > iptables -A INPUT -s xxx.xxx.xxx.xxx -p tcp --destination-port 25 > -j DROP > in succession, but none of these rules are achieving anything - i.e. the > diagnostic above keeps appearing in my /var/log/maillog. > Any ideas on how to proceed? The first command puts the rule at the beginning of the INPUT rules, but you didn't specify -p tcp, so I'm not sure it was effective. The next two puts the rule at the end of the INPUT rules. Is there an earlier rule which would accept the attempt? Is there another chain which accepts input requests? I suggest that you try it again with the third rule format but changed to -I, then look at all of your rules to see if there is an early rule or another chain which accepts. # iptables -nvL --line-numbers Use this command before and after the addition to see where it is. Also watch the counts. If the added rule is not being used, the count on that rule will remain at zero. -- Dale Dellutri (lose the Q's)