Re: News DoS using sendsys

[sgifford () tir com (Scott Gifford)]

> I think we (a local ISP in Augsburg/Germany ...) are hit by an DoS that
> wasn't described here before:
>
> Our newsserver (INN) all of a sudden gets several 100 'sendsys' requests
> per day. The addresses of the people requesting the sendsys seem to be
> completely random. They all seem to be normal user-accounts. We see
> these sendsys requests for about a week now.


  Yeah, this happened to us last week, only with many more than 100.  We had
sendsys mailing us, and it *still* killed our server from all the mail and
shlock processes.  We changed it to drop and killed off all of the processes
currently dealing with sendsys, and the problem went away.

  There are supposed to be some options in Cleanfeed 0.95.7 and newer to
deal with this, as well as other nasty INN tricks.  You can download it
from:

   http://www.exit109.com/~jeremy/cleanfeed.html
   ftp://ftp.exit109.com/users/jeremy/

-------Scott.