Exim Dictionary Attack ACL for cPanel

**sh4ka** · 10-13-2005 08:01 PM

Have anyone tried script "Exim Dictionary Attack ACL" for cPanel (http://www.configserver.com/free/eximdeny.html).. Any suggestions about it ?

**chris74108** · 10-13-2005 08:11 PM

Originally Posted by sh4ka

Have anyone tried script "Exim Dictionary Attack ACL" for cPanel (http://www.configserver.com/free/eximdeny.html).. Any suggestions about it ?

Works great! Chirpy is awesome.

**jameshsi** · 10-14-2005 12:06 AM

Just do it, don't worry about it, it is good.

**sh4ka** · 10-14-2005 12:14 AM

Oki doki.. I saw the same red "doggie" :P on the site of this script but I never imagine that that was chirpy's website, anyway.. I'll try it. thanks guys.

**chirpy** · 10-14-2005 04:48 PM

It's in my forum signature

**sh4ka** · 10-14-2005 05:55 PM

Chirpy, is that a dog or a pony ???

**verdon** · 10-15-2005 07:41 AM

looks like a corgi to me

**chirpy** · 10-15-2005 09:35 AM

It's an English Bull Terrier - we have 2 of the little mosters

hint: click on the logo on the configserver site.

**rs-freddo** · 10-15-2005 08:24 PM

Hey Chirpy,

any way to "permanently" ban the dictionary attack servers. I've had a dictionary attack going on for 3 weeks now. They seem to just be recycling the servers after your script drops them. I don't want to really "permanently" ban them - just set the number of days to keep a server banned.

**chirpy** · 10-16-2005 10:00 AM

If it's for one or two servers it's probably best to drop in a custom ACL for them:

Code:

  drop hosts = 11.22.33.44 : 11.22.33.55 : 11.22.33.66
       message = Spam or Mail Bombing activity

Stick that just before the exim deny ACL drops.

Alternatively, if you want the blanket ban to last longer, remove the symlink in /etc/cron.daily/exim_deny.pl and create a crontab to run that at the frequency that you want (e.g. every 3 days, etc).

**rs-freddo** · 10-16-2005 04:32 PM

Thanks Chirpy,

I'm embarrassed it was as simple as changing the cron job....
It's about 50 servers hammering me, so cron is the way to go.

**bijo** · 10-16-2005 05:28 PM

Originally Posted by chirpy

It's an English Bull Terrier - we have 2 of the little mosters

hint: click on the logo on the configserver site.

Thank you Jonathan

Finally we can see your photo from that link
http://chirpy.com

**Murtaza_t** · 10-17-2005 01:55 AM

Thanks Bijo.... I really wanted to see the head that carries those brains...

**brianoz** · 10-18-2005 08:32 AM

I can wholeheartedly recommend the dictionary ACL. A few months back one of our resellers moved a domain getting 70,000 spams a day with blackhole settings to our server. The jump in CPU usage was incredible - for just that one domain. After changing the default destination for the domain from blackhole to fail the server CPU load went back to normal almost immediately although it took a few days for the dictionary ACL to work it's magic and persuade the spammers to play elsewhere. I don't know how anyone could operate a server without the dictionary attack ACL.

**Website Rob** · 10-19-2005 12:29 AM

I would also agree, using the "Exim Dictionary Attack ACL" is a must have for any Server.

Touch of class on Chirpy's part, to provide it for Free. Even muddlehead's like myself can install it.

LinkBack

Thread Tools

Exim Dictionary Attack ACL for cPanel

Exim Dictionary Deny ACL for cPanel Servers

Dictionary Attack

:fail: is not working for dictionary attack (mail getting stored in exim queue)

Dictionary attack