    ANVIL(8)                                                 ANVIL(8)

    NAME
           anvil - Postfix client count and rate management

    SYNOPSIS
           anvil [generic Postfix daemon options]

    DESCRIPTION
           The  Postfix  anvil server maintains short-term statistics
           to defend against clients that hammer a server with either
           too  many parallel connections or with too many successive
           connection attempts within a configurable  time  interval.
           This  server is designed to run under control by the Post-
           fix master server.

    PROTOCOL
           When a remote client  connects,  a  connection  count  (or
           rate)  limited server should send the following request to
           the anvil server:

               request=connect
               ident=string

           This registers a new connection for the (service,  client)
           combination specified with ident. The anvil server answers
           with the number of simultaneous connections and the number
           of  connections  per  unit time for that (service, client)
           combination:

               status=0
               count=number
               rate=number

           The rate is computed as the  number  of  connections  that
           were  registered  in the current "time unit" interval.  It
           is left up to the server to decide if  the  remote  client
           exceeds the connection count (or rate) limit.

           When  a  remote client disconnects, a connection count (or
           rate) limited server should send the following request  to
           the anvil server:

               request=disconnect
               ident=string

           This  registers  a  disconnect  event  for  the  (service,
           client) combination specified with ident. The anvil server
           replies with:

               status=0

    SECURITY
           The  anvil server does not talk to the network or to local
           users, and can run chrooted at fixed low privilege.

           The anvil server maintains an in-memory table with  infor-
           mation  about  recent  clients  of  a connection count (or
           rate) limited service.  Although state is kept  only  tem-
           porarily, this may require a lot of memory on systems that
           handle connections from many remote  clients.   To  reduce
           memory  usage,  reduce  the  time unit over which state is
           kept.

    DIAGNOSTICS
           Problems and transactions are logged to syslogd(8).

           Upon exit, and every  client_connection_status_update_time
           seconds, the server logs the maximal count and rate values
           measured, together with (service, client) information  and
           the time of day associated with those events.

    BUGS
           Systems  behind  network  address  translating  routers or
           proxies appear to have the same client address and can run
           into connection count and/or rate limits falsely.

           In this preliminary implementation, a count (or rate) lim-
           ited server can have only one remote client at a time.  If
           a  server  reports  multiple simultaneous clients, all but
           the last reported client are ignored.

    CONFIGURATION PARAMETERS
           The following main.cf parameters are  especially  relevant
           to  this  program.  Use the postfix reload command after a
           configuration change.

           client_rate_time_unit
                  The unit of time over which  connection  rates  are
                  calculated.

           client_connection_status_update_time
                  Time  interval  for  logging the maximal connection
                  count and connection rate information.

    SEE ALSO
           smtpd(8) Postfix SMTP server

    LICENSE
           The Secure Mailer license must be  distributed  with  this
           software.

    AUTHOR(S)
           Wietse Venema
           IBM T.J. Watson Research
           P.O. Box 704
           Yorktown Heights, NY 10598, USA

                                                             ANVIL(8)