[Mimedefang] dictionary attacks looking for a valid user
Gary Funck
gary at intrepid.com
Fri Dec 16 16:08:04 EST 2005
> From: David F. Skoll
> Sent: Thursday, December 15, 2005 1:53 PM
>
> Unfortunately, MIMEDefang only sees exactly what was in the
> RCPT TO: command. It doesn't know the results of virtusertable
> changes.
>
> (Though it occurs to me that it can see the mailer, so if you
> map invalid addresses to something magical in virtusertable, and
> have that magical thing select the "error" mailer, then MIMEDefang
> might see it... have to test.)
David,
Can the "socket map" feature be put to work here?
SOCKET MAPS
If you have Sendmail 8.13 or later, and have compiled it with the
SOCKETMAP option, then you can use a special map type that communi-
cates over a socket with another program (rather than looking up a
key in a Berkeley database, for example.)
mimedefang-multiplexor implements the Sendmail SOCKETMAP protocol if
you supply the -N option. In that case, you can define a function
called filter_map to implement map lookups. filter_map takes two
arguments: $mapname is the name of the Sendmail map (as given in
the K sendmail configuration directive), and $key is the key to be
looked up.
More information about the MIMEDefang
mailing list