Implemented parts of policyd (cluebringer or cbpolicyd). (hate when kiddies decide to name things)

Set it up for a sliding 1 hour window and set metrics, and allow customers to go over by contacting us and putting them into a different bucket.

Has worked well so far. Since we only allow SASL authenticated relay – I set the authentication key to be their SASL username – what IP they come from doesn’t matter, so even if an account is breached and abuse is coming from multiple IP addresses – it is caught.

Best of luck!

Mike

We have a serious new Postfix system, and we had the same exact Nigerian nightmare as you write about here.

Yeah, it’s teh suck all rights!!

Nigerians were using stolen credit cards to sign up for accounts, and so far our newb-scribers have smartened up and aren’t sending their id’s/ps’s to them anymore. So far this month anywaze. We stopped the online sign-upability, but we still want to impose limits for the next inevitable phishing incident.

> On Wednesday, I implemented software that implements per user limits of number of
> authentications per hour.

So what change did you made? We’re looking to do exactly the same thing. I’m trying to find the specifics for my linux guy.

We’re also looking at running this milter, that counts outbound failures:
http://www.snertsoft.com/sendmail/milter-error/

Thanks!

Danny
Cyber Mesa Telecom
http://www.cybermesa.com