(none)   anomy-list@mailtools.anomy.net
/ help / lists / applications / search /
 

Re: Performance problem with postfix,filter.sh (advosys.ca) and spamassassin

From: Derrick Webber (
89768@xyz.molar.is)
Date: Tue 29 Jul 2003 - 02:39:02 GMT

  • Next message: list: "Re: Performance problem with postfix,filter.sh (advosys.ca) and spamassassin"

    list wrote:
    > I am the moment receiving a lot of mail bounces. Apparently somebody is
    > spamming and using my domain as from address.
    >
    > Anyway when this happens my rather modest server(in terms of hardware) is
    > unable to keep up with the load and bounces mail.
    > The problems seems to be that postfix keeps starting instances of
    > spamassassin.
    > Are there a way to limit the number of concurrent spamassasin postfix will
    > pipe to.
    >
    > (In order to to minimize the problem I have tried to use spamd/c but I do
    > not know wheter it is sufficient)

    This is really a Postfix and Spamassassin question rather than one for
    the Anomy users list.

    However... SpamAssassin is heavy on resources, period. Using spamc /
    spamd helps, but if your server is low on memory or processor speed it
    won't make a huge difference.

    You can limit how many SMTP messages Postfix will receive simultaneously
      by editing master.cf and changing the maxproc column for the the smtpd
    line. For example:

    smtp inet n - n - 10 smtpd

    (the above would change the max SMTP connections from 100 to 10).

    That's not a great solution, though... it'll limit your outbound mail
    too. If you have another server on your LAN that's less busy, perhaps
    you could install spamassassin on that and configure spamc to send the
    spam checking to it (ie. with "spamc -d").

    > BTW
    > Does anyone know wheter I am the target of a DOS or whether I am just
    > unlucky beeing used as spam origin.
    >
    Impossible to say without seeing the Postfix logs (and no, please don't
    post them here! ;-) That the messages are mostly bounces is a good sign
    a spammer used your domain as a fake return address. Usually a DoS
    attack against a mail server appears as a bunch of connections that
    timeout with no mail actually being sent, or a gazillion garbage
    messages to <postmaster>.

    -- 
      Derrick Webber  89768@xyz.molar.is
      Advosys Consulting Inc. Ottawa
      http://advosys.ca/
    --
    



  •