4
I want to dynamically block specific connections that use the same IP address based on a rate or connection limit. Is this possible using Solaris/IPF or some sendmail extension? I want to limit sendmail login attempts to prevent brute force attacks.
In Linux it's easily handled on the iptables firewall layer, but I haven't been able to figure out a way to use ipf to limit it on the firewall layer. Sendmail has a built-in rate limit and connection limit, but it appears to be applied to all users so if we're experiencing a DOS or DDOS it would block all our users instead of just the attacker.
when is sendmail ever not used in remote access mode? If i needed a local mail server, I would just purge Sendmail, and install Exim. – RapidWebs – 2014-07-02T17:11:05.283
Do you really require that sendmail not be run in local mode? Just allowing remote access to the daemon can be dangerous even with finite login attempts. Not to mention that now days even script kiddies can use a brute force attack with shifting ip's by piggy backing on other peoples botnets. – Blomkvist – 2011-05-14T23:49:12.453
Yes, it really needs to be accessible remotely. I understand the security implications, I just need to mitigate them. – Andrew Case – 2011-05-15T14:38:11.190