ANVIL(8)

NAME
anvil - Postfix client count and rate management

SYNOPSIS
anvil [generic Postfix daemon options]

DESCRIPTION
The Postfix anvil server maintains short-term statistics to defend against clients that hammer a server with either too many parallel connections or with too many successive connection attempts within a configurable time interval. This server is designed to run under control by the Postfix master server.

PROTOCOL
When a remote client connects, a connection count (or rate) limited server should send the following request to the anvil server:

request=connect
ident=string

This registers a new connection for the (service, client) combination specified with ident. The anvil server answers with the number of simultaneous connections and the number of connections per unit time for that (service, client) combination:

status=0
count=number
rate=number

The rate is computed as the number of connections that were registered in the current "time unit" interval. It is left up to the server to decide if the remote client exceeds the connection count (or rate) limit.

When a remote client disconnects, a connection count (or rate) limited server should send the following request to the anvil server:

request=disconnect
ident=string

This registers a disconnect event for the (service, client) combination specified with ident. The anvil server replies with:

status=0

SECURITY
The anvil server does not talk to the network or to local users, and can run chrooted at fixed low privilege. The anvil server maintains an in-memory table with information about recent clients of a connection count (or rate) limited service. Although state is kept only temporarily, this may require a lot of memory on systems that handle connections from many remote clients. To reduce memory usage, reduce the time unit over which state is kept.

DIAGNOSTICS
Problems and transactions are logged to syslogd(8). Upon exit, and every client_connection_status_update_time seconds, the server logs the maximal count and rate values measured, together with (service, client) information and the time of day associated with those events.

BUGS
Systems behind network address translating routers or proxies appear to have the same client address and can run into connection count and/or rate limits falsely. In this preliminary implementation, a count (or rate) limited server can have only one remote client at a time. If a server reports multiple simultaneous clients, all but the last reported client are ignored.

CONFIGURATION PARAMETERS
The following main.cf parameters are especially relevant to this program. Use the postfix reload command after a configuration change.

client_rate_time_unit
    The unit of time over which connection rates are calculated.

client_connection_status_update_time
    Time interval for logging the maximal connection count and connection rate information.

SEE ALSO
smtpd(8) Postfix SMTP server

LICENSE
The Secure Mailer license must be distributed with this software.

AUTHOR(S)
Wietse Venema
IBM T.J. Watson Research
P.O. Box 704
Yorktown Heights, NY 10598, USA