Greetings,
I am running a FC4 sendmail server and I've been trying forever to at
least limit some of the spam. In this effort, I have been adding to the
Access control (/etc/mail/access) domains that are known to be mail
bombing my domain. A few continue to evade the sendmail filtering and
are still getting through. I know this because LogWatch reports:
Unknown Local Users
invaliduser@xxxxxxxxxxxx
from *.speedy.net.pe ... (may be forged)
where * contains the specific client that continues to change. My first
attempt to block them, I added to /etc/mail/access
speedy.net.pe REJECT
to try and reject the problem domain. This doesn't work because
LogWatch continues to report to me that mail is coming in. I've tried
to reject on the IP as follows:
201.230.19.113 REJECT
but of course, they just changed IP address.
Can anyone explain to my the whole in my security that is allowing them
to get through and how to plug it?
Thank you in advance.
