Help I´m Getting my server slammed with hundreds of connections

[kran]

Since about a Week I´m getting 3 of my servers hit with many connections from the same Ip´s and they endup overloading the server to a halt.

I´ve keep putting this ips in the deny list of csf firewall but they come with new ips.

I have spamassasing active, chirpys dictionary, the new ACL´s.

There is any way I can limit the SMTP connection per IP to let´s say 50 or less?

This is how the log looks.


2007-12-04 10:51:50 [7984] SMTP connection from [89.167.46.28]:1128 I=[64.191.xx.xx]:25 (TCP/IP connection count = 74)
2007-12-04 10:51:50 [7984] SMTP connection from [65.70.74.193]:50463 I=[64.191.xx.xx]:25 (TCP/IP connection count = 75)
2007-12-04 10:51:50 [7984] SMTP connection from [190.28.127.202]:1324 I=[64.191.xx.xx]:25 (TCP/IP connection count = 76)
2007-12-04 10:51:50 [7984] SMTP connection from [209.89.64.169]:62647 I=[64.191.xx.xx]:25 (TCP/IP connection count = 77)
2007-12-04 10:51:50 [7984] SMTP connection from [207.108.77.2]:11893 I=[64.191.xx.xx]:25 (TCP/IP connection count = 78)
2007-12-04 10:51:50 [7984] SMTP connection from [66.162.37.243]:45770 I=[64.191.xx.xx]:25 (TCP/IP connection count = 79)
2007-12-04 10:51:50 [7984] SMTP connection from [64.18.2.169]:53720 I=[64.191.xx.xx]:25 (TCP/IP connection count = 80)
2007-12-04 10:51:50 [7984] SMTP connection from [194.151.226.36]:47496 I=[64.191.xx.xx]:25 (TCP/IP connection count = 81)
2007-12-04 10:51:50 [7984] SMTP connection from [201.234.137.188]:1611 I=[64.191.xx.xx]:25 (TCP/IP connection count = 82)
2007-12-04 10:51:50 [7984] SMTP connection from [201.234.137.188]:1612 I=[64.191.xx.xx]:25 (TCP/IP connection count = 83)
2007-12-04 10:51:50 [7984] SMTP connection from [61.218.236.210]:57730 I=[64.191.xx.xx]:25 (TCP/IP connection count = 84)
2007-12-04 10:51:50 [7984] SMTP connection from [88.76.197.10]:1602 I=[64.191.xx.xx]:25 (TCP/IP connection count = 85)
2007-12-04 10:51:50 [7984] SMTP connection from [201.234.137.188]:1616 I=[64.191.xx.xx]:25 (TCP/IP connection count = 86)
2007-12-04 10:51:50 [7984] SMTP connection from [83.110.53.49]:3696 I=[64.191.xx.xx]:25 (TCP/IP connection count = 87)
2007-12-04 10:51:51 [7984] SMTP connection from [59.95.195.241]:54948 I=[64.191.xx.xx]:25 (TCP/IP connection count = 88)
2007-12-04 10:51:51 [7984] SMTP connection from [66.0.0.68]:27853 I=[64.191.xx.xx]:25 (TCP/IP connection count = 89)

[serversignature]

hi,

I think ...you should go for controlling the resource as explained at
http://www.exim.org/exim-html-curren....html#SECID105

smtp_accept_max_per_connection messages per connection
smtp_accept_max_per_host connections from one host
smtp_accept_queue queue mail if more connections

thanks,

[kran]

I modified smtp_accept_max_per_host and it seems to help a lot.

[jarodlwk]

I have the same problem. I have set my smtp_accept_max_per_host = 15 and smtp_accept_max = 50. But I still get the logs as below:

SMTP connection from [218.208.230.103] (TCP/IP connection count = 48)
SMTP connection from [58.9.144.183] (TCP/IP connection count = 49)
SMTP connection from [143.166.224.119] (TCP/IP connection count = 49)
SMTP connection from [68.161.206.234] (TCP/IP connection count = 50)

The max connection does not exceed the limit of 50 but each host exceeded the limit of 15. What did I do wrong?