SUMMARY: URGENT: DoS via sendmail

Special thanks to the following:

George Schlossnagle, David Luyer, sunguy, and Andrew J Caines.

George mentioned to /usr/sbin/snoop port 25 and sunguy mentioned
to netstat -an to shows the IP (my mail.log does not shows the IP)
and then do "route add -host <IP> 127.0.0.1" or at the router.
I decided to do at the router (Cisco).

I then do "ip route 200.101.197.0 255.255.255.0 Null0" at the router
and now the server load seems to go down drastically.  netstat -an shows
a bunch of...

mail.25       200.101.197.216.4910     0      0 10080      0 SYN_RCVD
mail.25       200.101.197.216.4910     0      0 10080      0 SYN_RCVD

Guess when you can't type at your console and stop/start sendmail,
it's hard to come up with a solution.  Thanks again guys.

*whew* I'm glad someone is reading the list on a Friday night...


- Mike


---------- original message ----------

Jun 13 22:10:55 pulsar sendmail[821]: WAA00821: <arxc@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[790]: WAA00790: <arxf@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[783]: WAA00783: <arxh@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[777]: WAA00777: <arx1@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[809]: WAA00809: <arxd@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[767]: WAA00767: <arx93@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[808]: WAA00808: <arxe@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[778]: WAA00778: <arxf@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[770]: WAA00770: <arxer@sky.net>... User
unknown
Jun 13 22:10:55 pulsar sendmail[789]: WAA00789: <arxg@sky.net>... User
unknown

Some system/one is going through some sort of list in attempt to spam
our users. However, this is taking a toll on the server, above is from
my mail.log --how can I determine where the e-mail is coming from to
stop and/or filter out the culprit, the above doesn't shows the source.

Hope this makes it to the list, system load is at 30+ and typing in a
character practically took several seconds...I'm sitting here stop/start
sendmail to lower the load and to type for help.  Thanks.


- Mike
_______________________________________________
sunmanagers mailing list
sunmanagers@sunmanagers.org
http://www.sunmanagers.org/mailman/listinfo/sunmanagers
_______________________________________________
sunmanagers mailing list
sunmanagers@sunmanagers.org
http://www.sunmanagers.org/mailman/listinfo/sunmanagers