Mailbomb

A few days ago my rt was victim of a mailbomb from a child.

Anyone here is using anything to handle this problem? I know that this is
not a RT problem, but maybe someone had the same problem and find a
solution to avoid it to happen again in the future.

(OK, after all this I blacklisted the sender e-mail in RT and sendmail,
but the damage was already made)

messagewall, is pretty nice. you use it to scan for viruses as well as
prevent spam. I think you can set a maximum number of recipients it
will accept messages for.

Hermann Wecke wrote:

messagewall, is pretty nice. you use it to scan for viruses
as well as
prevent spam. I think you can set a maximum number of recipients it
will accept messages for.

Or alternatively, MIMEDefang, SpamAssassin and your favourite Linux virus
scanner (I use ClamAV, which seems to work well).

I tried MessageWall, but it had a couple of odd issues on our site. Still,
it has a lot of promise.

As for the mailbomb (to the original poster), what damage did it do to RT?

This correspondence is for the named person’s use only. It may contain
confidential or legally privileged information or both. No confidentiality
or privilege is waived or lost by any mistransmission. If you receive this
correspondence in error, please immediately delete it from your system and
notify the sender. You must not disclose, copy or rely on any part of this
correspondence if you are not the intended recipient.

Any opinions expressed in this message are those of the individual sender.

Or alternatively, MIMEDefang, SpamAssassin and your favourite Linux virus
scanner (I use ClamAV, which seems to work well).

spamassassin was active when the flood came in. All messages was scored
above 4 points. So I changed the trigger to 4. I just need to keep an eye
on the rtspamfolder (not an issue, actually) for those rejected messages.

As for the mailbomb (to the original poster), what damage did it do to RT?

Except creating a few hundred new tickets, sending messages to all queue
members and giving me a few minutes of “change status” work, no damage at
all.

I’m just trying to avoid the same problem in the future. Lowering the
spamassassin score may help me, except if the mailbomb itself will not
scroe even the 4 points…