Massive Postfix Queue's!

[Tekati]

Here is the output of a simple qshape

                          T    5   10   20   40   80   160   320  640 1280 1280+
                TOTAL 93620 1389 1222 2669 5056 9680 21957 44912 6735    0     0
          xxxxx.net 92456 1364 1205 2643 5000 9566 21694 44334 6650    0     0
           xxxxx.com   299    4    7    7   16   34    71   135   25    0     0
xxxxx.com   255    3    3    2   11   23    60   132   21    0     0
         xxxx.com   250    4    1    7   12   31    53   123   19    0     0
      xxx.com   232    9    1    7   12   14    43   132   14    0     0
         xx.com    44    1    4    1    2    6     6    19    5    0     0
        xxxxxx.org    20    1    0    0    1    2     3    13    0    0     0
 xxxxx.org    20    1    0    0    0    1    13     5    0    0     0
        xxxx.net    16    0    1    0    1    2     1    10    1    0     0
            x.com     7    0    0    0    0    0     5     2    0    0     0
   xxxxxxx.com     5    1    0    0    0    0     1     3    0    0     0
      xxx.xxxxx.net     4    1    0    1    1    0     1     0    0    0     0
              xxxx.net     3    0    0    0    0    0     3     0    0    0     0
              xxxxxxxx.com     3    0    0    0    0    0     2     1    0    0     0
            xxxxxxxxx.com     3    0    0    0    0    0     1     2    0    0     0
         xxxxxxxxxx.com     1    0    0    0    0    0     0     1    0    0     0
        xxx.net     1    0    0    1    0    0     0     0    0    0     0
xxxx.org     1    0    0    0    0    1     0     0    0    0     0

Here is a qshape active

                                T  5 10  20  40   80   160   320  640 1280 1280+
                      TOTAL 77359  5 17 175 840 3938 20190 44822 7372    0     0
                    xxxxxxx.net 76401  5 16 173 832 3904 19950 44249 7272    0     0
                     xxxxxx.com   241  0  1   0   2    9    69   132   28    0     0
      xxxxxxxxxxxxxxxxx.com   217  0  0   0   1    8    55   130   23    0     0
                    xxxxxxx.com   212  0  0   1   4   11    52   122   22    0     0
               xxxxxxxxxxx.com   188  0  0   1   1    2    37   127   20    0     0
                   xxxxxxxx.com    32  0  0   0   0    3     5    18    6    0     0
           xxxxxxxxxxxxxxx.org    18  0  0   0   0    0     6    12    0    0     0
                     xxxxxxxx.org    16  0  0   0   0    0     3    13    0    0     0
                   xxxxxxxxx.net    12  0  0   0   0    0     1    10    1    0     0
                       xxxxxx.com     7  0  0   0   0    0     5     2    0    0     0
            xxxxxxxxxxxxxx.com     4  0  0   0   0    0     1     3    0    0     0
                            xxx.net     3  0  0   0   0    0     3     0    0    0     0
                           xxx.com     3  0  0   0   0    0     2     1    0    0     0
                        xxxxx.com     3  0  0   0   0    0     1     2    0    0     0
                     xxxxxxx.com     1  0  0   0   0    0     0     1    0    0     0
   xxxxxxxxxxxxxxxxxxxxx.org     1  0  0   0   0    1     0     0    0    0     0

Here is a qshape incoming

                              T    5   10   20   40   80  160 320 640 1280 1280+
                    TOTAL 17013 1210 1275 2635 4178 6005 1710   0   0    0     0
              xxxxxxx.net 16803 1205 1250 2606 4132 5923 1687   0   0    0     0
               xxxxxxx.com    57    2    6    7   15   26    1   0   0    0     0
          xxxxxxxxx.com    45    0    7    7    8   16    7   0   0    0     0
             xxxxxxxxx.com    40    1    4    5    7   18    5   0   0    0     0
    xxxxxxxxxxxxxxxxxx.com    39    1    5    3    8   15    7   0   0    0     0
             xxxxxxxx.com    12    0    1    4    3    2    2   0   0    0     0
          xxx.xxxxxxx.net     5    1    0    1    2    0    1   0   0    0     0
            xxxxxxxx.org     4    0    1    0    1    2    0   0   0    0     0
            xxxxxxxx.net     4    0    0    1    1    2    0   0   0    0     0
      xxxxxxxxxxxxxx.org     2    0    1    0    0    1    0   0   0    0     0
            xxxxxxxx.net     1    0    0    0    1    0    0   0   0    0     0
       xxxxxxxxxxx.com     1    0    0    1    0    0    0   0   0    0     0

Here is a qshape outgoing

                                         T  5 10 20 40 80 160 320 640 1280 1280+
                                  TOTAL  0  0  0  0  0  0   0   0   0    0     0

This was with the Multiple Debian setup straight from the manual.

Obviously we are being targeted by massive dictionary attacks.

What can I change in the configuration to fix this?

Any suggestions???

[till]

Dictionary attacks are not related to the number of mails in the queue as a dictionary attack is just a auth request. You can block dictionary attacke e.g. with fail2ban:

http://www.fail2ban.org/wiki/index.php/Postfix