Jason Hornbuckle 13.Mar.14 08:37 PM a Web browser Domino Server 7.0.2 Linux - RedHat
Is it possible to use Domino Server Monitoring Configuration to monitor the amount of time an inbound SMTP server connection has been established - then after a specifiied time limit, drop the connection or bounce the SMTP server task?
Here is my predicament:
For the last couple of weeks we are copping some kind of targeted spam attack. The source host opens an SMTP connection to our server, then attempts to send email messages about once every second. The connection is kept open for hours on end or until I manually stop and restart the SMTP server task to cause it to drop. We have a 3rd party spam filter in place which identifies the email content as spam and automatically deletes the message from the mail.box database before delivering it to the users but it cannot drop the smtp connection which is the source of the spam so it just keeps piling in chewing up resources. At any one time there may be 3 or 4 hosts with connections kept open sending in spam. When I drop the connections by stopping and starting the SMTP server, new connections are sooon established with different source IP addresses - so ip filters or blacklists wont work. After I have manually killed the connections it does take a little time for new ones to re-establish so the only answer I can come up with is to somehow drop the smtp connections after either a specified amount of emails or time has passed? It wont stop it straight away but will slow it down to an acceptable level?
Unfortunately the SMTPErrorLimit ini setting does not work either as our spam filter intercepts the email before the domino rules can be applied. I'm hoping maybe I can do something with the Monitoring Configuration to look for SMTP connections that stay open for abnormally long periods of time?