SMTP - too many connections

[SupermanInNY]

Hi All,

I have been experiencing a situation where I get lots of connections to send out emails (SMTP) from countries where I have no users.
Raising the number of concurrent connections helped, but it ties the system's resources for no good reason.
Is there an 'block connection for smtp' option?
I'm not talking about getting emails from those countries, I'm talking about connections to try to spam though my server.
They are not able to do that of course, but they just cause a DoS on sending out emails.
Any pointers on how to overcome this?
Yes,. IPTables is a suggestion, but would that block incoming traffic of emails sent TO my server? not just connecting to my server to Email OUT (relay)?

Thanks for any input.

-Alon.

 

[elaine]

Hi,
Add in your exim.conf file after the check_meesage with line below:

# Reject spam messages with score over 10, using extra condition
deny message = This message scored $spam_score points. Congratulations!
spam = nobody:true
condition = ${if>{$spam_score_int}{100}{1}{0}}

 

[SupermanInNY]

Hi,
Add in your exim.conf file after the check_meesage with line below:

# Reject spam messages with score over 10, using extra condition
deny message = This message scored $spam_score points. Congratulations!
spam = nobody:true
condition = ${if>{$spam_score_int}{100}{1}{0}}

Thanks for the update.
The source of the problem I was experiencing was due to leftovers of sorbs checks that I didn't remove from the exim.conf. So I was just seeing a lot of timeouts/hanging for timeouts.

With that said, I'm trying to understand your proposed solution and see if it can/should be further integrated into my current exim.conf.

I have several RBLs that I'm checking against, for example:


# deny using spamcop
deny message = Email @our server blocked by SPAMCOP - to unblock see http://www.my domain.com/ with the message.
hosts = !+relay_hosts
domains = +use_rbl_domains
!authenticated = *
dnslists = bl.spamcop.net


How does your solution integrates into this block?

Thanks again for the input.

-Alon.