[SOLVED] Problem with brute force spamming

81bones · 10-13-2006, 12:06 PM

I'm not sure if there's anything I can do about this, but I figured it was worth a shot to ask. For almost 48 hours now my mail server has been "under attack". I am receiving a steady steam of email to non-existant, fake users. The messages are to addresses like "squatternascentQ@domain.net" and "Buddyl0Olsen@domain.net". I've received literally thousands of these emails (and still am as we speak). The messages are always rejected since the users don't exist:

Code:

 Out: 220 computer.domain.net ESMTP Postfix (2.2.5) (Mandrakelinux)
 In:  HELO ns2.uba.ar
 Out: 250 computer.domain.net
 In:  MAIL FROM:<>
 Out: 250 Ok
 In:  RCPT TO:<Elliotz5Humphrey@domain.net>
 Out: 450 <Elliotz5Humphrey@domain.net>: Recipient address rejected: User
     unknown in local recipient table
 In:  QUIT
 Out: 221 Bye

but the continual stream of them is ridiculous. The source IP on each message is almost always different but I find it hard to believe that this is not a coordinated or automated attack from a single source. Spoofing maybe? Anyway, for the time being I've closed port 25 on my router to all traffic -- it stops the spamming but of course now I can't receive any mail for legitimate users. If I open the port back up, I will start receiving the messages again. Has anyone had this happen to them? Any suggestions? Help!

WindowBreaker · 10-13-2006, 09:20 PM

It sounds like an attack, and not just random spammers. Expecially if it's as constant as you say.

Congratulations on correctly configuring postfix to reject non-existent users. If it were me, I'd just keep an eye on it and let postfix continue to reject as it is.