[Logwatch-Devel] sendmail greet_pause entries

Mike Tremaine mgt at stellarcore.net
Wed Feb 2 11:34:55 MST 2005


On Wed, 2005-02-02 at 07:38, Kenneth Porter wrote:
> sendmail 8.13 now includes FEATURE(greet_pause,5000). This feature delays 
> the initial banner displayed in an SMTP transaction by the specified 
> timeout. If any traffic is received before this, sendmail closes the 
> connection with an error. This blocks spammers who "slam" their traffic 
> rapidly down the wire and disconnect.
> 
> Here's some sample log lines from /var/log/maillog (watch for wrap):
> 
> Feb  1 21:15:10 newred sendmail[20875]: j125FAm5020875: rejecting commands 
> from smtp.vzwpix.com [66.174.76.42] due to pre-greeting traffic
> Feb  1 21:40:42 newred sendmail[21002]: j125egOc021002: rejecting commands 
> from [220.87.204.90] [220.87.204.90] due to pre-greeting traffic
> Feb  1 21:48:58 newred sendmail[21016]: j125mwoj021016: rejecting commands 
> from RODRIGUEZ.AGENCYTRX.COM [63.123.149.41] due to pre-greeting traffic
> Feb  2 00:03:43 newred sendmail[21371]: j1283hPh021371: rejecting commands 
> from [193.140.171.251] [193.140.171.251] due to pre-greeting traffic
> 
> What would be a good way to present this data in the logwatch summary? 
> Should there just be a summary count, or a list of addresses and counts 
> (such as the summary for unresolved domains)?
> _

Nice feature guess it is time to push some upgrades around.

I think I full listing [with an option to turn it off or limit it to
just totals] would be good. Ala Blackhole totals, ofcourse make sure its
numbers get added to the Total_Rejected output as well.

my .02


-- 
Mike Tremaine
mgt at stellarcore.net
http://www.stellarcore.net



More information about the Logwatch-Devel mailing list