[TriLUG] spam attack help?

[jonc at nc.rr.com]

Just as a cautionary note, a lot of our support email goes out from Salesforce, which uses multiple mail servers, so our mail comes from multiple IP addresses. In cases like that, you might want to extend the time of your auto-white list. Or setup cetain IP's that that are permanently on the white list.

Jon

---- "Cristóbal Palmer" <cristobalpalmer at gmail.com> wrote: 
> On Wed, Apr 2, 2008 at 1:24 PM, Scott Lambdin <lopaki at gmail.com> wrote:
> What about the time delay?  People like to use email like chat.

When I set up sqlgrey it had the option to whitelist senders after a
threshold. After I get 10 emails from sally at example.net and all of
them from the same IP, I whitelist sally at that IP. After I get 30
emails from at least two more senders @example.net from that same IP,
I whitelist the IP. This auto-whitelist expires after 31 days if I
don't see any more mail from the IP/sender.

sqlgrey is pretty hot.

Cheers,
-- 
Cristóbal M. Palmer
http://tinyurl.com/3apraw "They also abandoned other volumes, later,
while fleeing from the librarians."
-- 
TriLUG mailing list        : http://www.trilug.org/mailman/listinfo/trilug
TriLUG Organizational FAQ  : http://trilug.org/faq/
TriLUG Member Services FAQ : http://members.trilug.org/services_faq/