tlug: Spam mail

[Frank Bennett <bennett@example.com>]

Some members of the list will undoubtedly have received a porno
posting recently, which shows a bogus Nagoya University address
in the "From:" field.  This may have been a spite attack on our
site, and I'm writing to see whether anyone has any bright ideas
that I could pass on to the mail administrators here.

The attack involved a large volume of postings from at least five
separate access points to the AT&T ISP inside the US.  Nothing
passed through Nagoya University -- servers elsewhere were used
as relays -- but the "From:" field was spoofed, so that replies
would land on the central mail server (on which we in Law,
happily, do not rely).

Within a day after the attack, the server had received at least
20,000 complaint messages (or, who knows, requests for further
details?), all of which were rejected because the "user"
identified in the From: field was bogus.

AT&T, the Feds and CERT have all been notified.  But what I'm
curious about is whether anyone on the list has worked out a
systematic response to cope with such an attack on the server
(Perl scripts to strip extraneous rubbish from syslog as it
builds up, quickie fixes to route mail into /dev/null, that sort
of thing).  Any words of wisdom that I receive concerning what
should and shouldn't be done in such an emergency, I'll pass on
to the folks at the troubled console.

Cheers,
-- 
-x80
Frank G Bennett, Jr         @@
Faculty of Law, Nagoya Univ () email: bennett@example.com
Tel: +81[(0)52]789-2239     () WWW:   http://rumple.soas.ac.uk/~bennett/
----------------------------------------------------------------
Next Nomikai: 20 November, 19:30   Tengu TokyoEkiMae 03-3275-3691
Next Technical Meeting: 12 December, 12:30 HSBC Securities Office
----------------------------------------------------------------
more info: http://tlug.linux.or.jp Sponsors: PHT, HSBC Securities