I am getting hit with a distributed dictionay email attack

[dezignguy]

How do I block spoofed IPs? I'm at over 15,000 and rapidly increasing

# cat exim_deny | wc -l
15437

Actually, there are a couple settings you can do to help the OS recognize and reject packets from spoofed ips... you'll have to search this forum and possibly google to find them though.

I think putting

ALL: PARANOID

into /etc/hosts.deny is one way... but I'm not real positive on that, or exactly what that does, so look it up first.

[Radio_Head]

why you don't simply change the mx record of the domain name under attack with one of these ips ?

[chirpy]

Please be more careful - this is a 2 year old thread.