limit connections

[Marcus Schopen]

Hi Shawn,

Am Freitag, den 23.12.2016, 16:01 +0000 schrieb Shawn Bakhtiar via
Info-cyrus:
> Well... you really should take this to the Ubuntu iptables; Start
> there and they may be able to give you a better mail list that deals
> specifically with iptables: 
> https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
> 
> 
> Having said that you don't necessarily need to use
> the iptables-extensions --rsource option, you can just use --limit
> which is in the standard iptables. This is a debian example but works
> for any iptables based system:
> https://debian-administration.org/article/187/Using_iptables_to_rate-limit_incoming_connections
> 
> 
> However, I digress, back to the topic at hand, doing this, is going to
> send the users client (based on the client) into a tif. It's going to
> assume the server has gone down and warn the user about a lost
> connection, I imaging a user who is unwilling to change his pop
> interval is going to be even more pissed at having his client pop up
> with connection lost messages. 
> 
> 
> IMHO it would be far more professional to first implement a rule
> change (update their agreement, or make a corporate policy change)
> than inform users not following those policies/agreements that if they
> don't comply their accounts will be disabled. This is not only good
> corporate governance but it is also non-discriminatory, which means
> the offending user is far less likely to be mad, and far more
> embarrassed that it had to come to this.
> 
> 
> Doing what your trying to do, is going to make it look like your
> servers are not working. The user may not understand why every so
> often the client complains that the connection to the server is not
> working, and in fact may result in breach of contract/policy if no
> previous policy/agreement has been put into place regarding the issue.
> 
Thanks for time. I definitely agree to your arguments and I'm on not
that kind of BOFH, who harms users. But if you ask over weeks to stop
that nonsense and the user reduces the interval from 30 seconds to 2
seconds, it's time to play a harder game. And yes, there is an contract,
which allows me to disable accounts or block connections, if a user
harms, attacks or penetrates the system. Technically the client is an
exchange server using popcon to fetch emails. So I guess they will have
some errors in log files of their wild running box, if I block new
established connections in between.

Happy Christmas to all, have a good time and hope to read you next year!

Cheers,
Marcus