Michael,
> That problem doesn't exists with the approach that uses IPTables and the
> "recent" module. All bans/blocks happen instantly, are temporary and expire
> by themselves. Adding an address to the banlist or removing it doesn't
> require a restart of the firewall itself. Likewise, the entire procedure
> happens on the kernel level, so you don't need to do parse logfiles
> periodically.
You mean you don't have to parse the /var/log/maillog? How do you detect the dictionary
attackers?
Is the "recent module" a standard part of IPTables?
Herb
--
Herb Rubin
Pathfinders Software
http://www.pfinders.com