msys.dp_config.audit_series.mailfrom
MAIL FROM rate limiting. Note this is disabled by default as there is a potential for a DoS attack using garbage sender addresses.
Find below the sample excerpt included in the dp_config.lua
file.
msys.dp_config.audit_series.mailfrom = {
type = "string",
interval = 900,
buckets = 4,
thresholds = {
{ check = true,
startv = 0,
endv = 3,
threshold = 100,
honor_whitelist = { "global" }
}
},
options = {
persist = true
}
};
The elements of this configuration table are as follows:
- type
-
The only legal value for this element is
string
. - interval
-
The time interval that you wish to look at measured in seconds. A reasonable value might be
900
. - buckets
-
A bucket is a window of time of the length defined by "interval". A reasonable value might be
4
. - thresholds
-
Count over which rejection happens.
thresholds
is a nested table within this configuration option. The following list defines the attributes of the individual thresholds.- check
-
Whether or not to use this configuration item.
- startv
-
The starting bucket (0 is the current bucket) to query across.
- endv
-
The ending bucket.
- threshold
-
The count that triggers this threshold. When this threshold is exceeded the code
451
is issued with the messageSender message rate limit exceeded
. - honor_whitelist
-
A table listing any applicable whitelists set in the
msys.dp_config.whitelist
table.
- options
-
This item is a table with the following possible keys:
- serialize
-
Write audit series to log. The value may be
true
orfalse
;false
is the default.When
true
, the log will be written to the directory defined by theserialize_dir
option in the inbound_audit module. The default value for this option is/var/log/ecelerity/audit_series_persist
. - replicate
-
Defaults to none, but can be
cluster
to send to all nodes, ormanager
to send only to cluster manager nodes. This requires explicit configuration in thecluster
stanza to operate correctly. For more information see Data Replication. - persist
-
When set to
true
, the audit series will be persisted. The persisted series will be reloaded when the engine restarts. The default value isfalse
.