[SATLUG] Possible Email Attacks

[Daniel J. Givens]

Brad Taylor wrote:
  >     It looks like my server is rejecting the connection as it should,
> but I had a question about blocking this before it gets to the server.
>     I traced the IP back to an Asia-Pacific area according to ARIN. If I 
> put a block on the IP address in IPTABLES would that be a wise decision?

This is extremely common. One server that I run collects about 5MiB 
worth of mail logs a day and 99.999% of that is from rejects. It is 
absolutely nothing to worry about because there isn't much more you can 
do about it than you are already are. You could think about using some 
good blacklists and dropping the verbosity on your logs, but that's not 
necessary and could hurt you more than help in the end.

SMTP is one of those services that you need to have open since it's 
hardly likely you know each and every server that's going to be sending 
you mail. If you start blocking whole sections of the Internet, you 
might block legit mail from getting to you. That's a decision you should 
make for yourself. What matters is that you're not an open relay for the 
bots.