[Mimedefang] dictionary attacks looking for a valid user

Gary Funck gary at intrepid.com
Fri Dec 16 16:08:04 EST 2005


> From: David F. Skoll
> Sent: Thursday, December 15, 2005 1:53 PM
> 
> Unfortunately, MIMEDefang only sees exactly what was in the
> RCPT TO: command.  It doesn't know the results of virtusertable
> changes.
> 
> (Though it occurs to me that it can see the mailer, so if you
> map invalid addresses to something magical in virtusertable, and
> have that magical thing select the "error" mailer, then MIMEDefang
> might see it... have to test.)

David,

Can the "socket map" feature be put to work here?

SOCKET MAPS
       If you have Sendmail 8.13 or later, and have compiled  it  with  the
       SOCKETMAP  option, then you can use a special map type that communi-
       cates over a socket with another program (rather than looking  up  a
       key in a Berkeley database, for example.)
 
       mimedefang-multiplexor implements the Sendmail SOCKETMAP protocol if
       you supply the -N option.  In that case, you can define  a  function
       called  filter_map  to  implement map lookups.  filter_map takes two
       arguments:  $mapname is the name of the Sendmail map  (as  given  in
       the  K  sendmail configuration directive), and $key is the key to be
       looked up.





More information about the MIMEDefang mailing list