Alerting if ratelimits are hit

kate

Hi,
I have an ongoing issue with user accounts being used for spam.
one mechanism I had considered to mitigate and discover this in a proactive fashion was applying rate limits to accounts, and get alerting if those limits are hit.

Does this sound viable ? If so is there a mechanism to discover if an a/c is hitting the rate limits ?

If it’s not viable I am open to suggestions for other techniques for limit a/c spam
Thanks,
Kate

esackbauer

kate issue with user accounts being used for spam

Why? The users did not change their passwords? Was your mailcow hacked and all accounts were compromised?

kate

esackbauer

Hi thank you. I have 5k users and sometimes one of them gets hacked or brute forced or uses a stupid password.
i believe it’s a common problem with ESP’s and was looking for some support on mechanisms to limit and mitigate the damage that they can cause.
Thanks
kate

esackbauer

Only thing that comes to my mind is parse the log files for the hitting of the rate limit. Have not done it, though.
This is what I found, maybe you can set up notifications with rspamd:
https://groups.google.com/g/rspamd/c/crt-Rn1tIxw