I have the following set:

g_bad_login_allow = "5"
g_bad_login_mins = "10"

If the bad guys try 5 times, the account is locked for 10 minutes.  I find this discourages them enough and the 10 min timeout is enough to keep the legit customer from screaming at you.  They tend to understand and if they wait 10 minutes, they can send just fine.

But again, look at your logs and find out what is happening and maybe even block the bad ip address(if the bad guys are using the same IP address) at your router.

Don't know what OS you are running, but under Linux, there are apps to add addresses to IPTables dynamically by reviewing logs.  These were developed because of hacker attacks directed at Asterisk servers(fail2ban).

Lyle

Tom Cross wrote:

Once I set OK to send from multiple IP they could send again.
But I don't really want to do that when there is a spammer on the other IP.

Tom Cross
Partner (Synergist)
HTMLnet
61 2 9288 9488
0418 295 336
tomc@html.com.au

On Monday 14/02/2011 at 01:00:03, Lyle Giese wrote:

Tom Cross wrote:

Hi All
I received the following 2 emails
==========================================================================================
Mail 1
Important report from SurgeMail html.com.au host=guru - see details below

Spammer sending detected on 202.171.168.xxx from multiple ip addresses, change users password urgently,
or set g_breakin_white xxxxxx@html.com.au or disable by setting to *

Mail 2
Important report from SurgeMail html.com.au host=guru - see details below

Spammer sending detected on 86.197.28.155 from multiple ip addresses, change users password urgently,
or set g_breakin_white xxxxxx@html.com.au or disable by setting to *
==========================================================================================

The 202 address is the correct address.
The password was changed, but the customer still could not send out through our SurgeMail server.
What else do I need to do???? to allow them to send again.

I have also black listed the 86 address.

Tom Cross
Partner (Synergist)
HTMLnet
61 2 9288 9488
0418 295 336
tomc@html.com.au

Is their account locked out due to excessive bad password attempts?

I think you need to parse the logs a bit and find out why they are having problems sending.  You apparently have been talking to them.  Get their public ip address and have them try to send a test message and look at the logs.

Once you determine the error Surgemail is generating the proper remedy can be applied.

Lyle Giese
LCR Computer Services, Inc.