{"action":"created","issue":{"url":"https://api.github.com/repos/vstakhov/rspamd/issues/515","repository_url":"https://api.github.com/repos/vstakhov/rspamd","labels_url":"https://api.github.com/repos/vstakhov/rspamd/issues/515/labels{/name}","comments_url":"https://api.github.com/repos/vstakhov/rspamd/issues/515/comments","events_url":"https://api.github.com/repos/vstakhov/rspamd/issues/515/events","html_url":"https://github.com/vstakhov/rspamd/issues/515","id":131582906,"number":515,"title":"Feature: add Ratelimit for authenticated senders (outgoing messages)","user":{"login":"wackerm","id":12646771,"avatar_url":"https://avatars.githubusercontent.com/u/12646771?v=3","gravatar_id":"","url":"https://api.github.com/users/wackerm","html_url":"https://github.com/wackerm","followers_url":"https://api.github.com/users/wackerm/followers","following_url":"https://api.github.com/users/wackerm/following{/other_user}","gists_url":"https://api.github.com/users/wackerm/gists{/gist_id}","starred_url":"https://api.github.com/users/wackerm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wackerm/subscriptions","organizations_url":"https://api.github.com/users/wackerm/orgs","repos_url":"https://api.github.com/users/wackerm/repos","events_url":"https://api.github.com/users/wackerm/events{/privacy}","received_events_url":"https://api.github.com/users/wackerm/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-02-05T08:18:21Z","updated_at":"2016-02-22T10:11:09Z","closed_at":null,"body":"it would be very nice if it would be possible (for e.g. via expiring redis entries) to add a rate limit for messages based on the authenticated sender information (sasl-username).\r\n\r\nthis could prevent incidents, where the users pc is infected and abused to send spam or the user credentials had been leaked...\r\n\r\nso it should be possible to rate limit an authenticated sender to send no more than for e.g. 100 messages per hour or 5 per minute or something like this, together with the leaking bucket concept this should work fairly well and could be monitored in the logs...\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/vstakhov/rspamd/issues/comments/187106728","html_url":"https://github.com/vstakhov/rspamd/issues/515#issuecomment-187106728","issue_url":"https://api.github.com/repos/vstakhov/rspamd/issues/515","id":187106728,"user":{"login":"wackerm","id":12646771,"avatar_url":"https://avatars.githubusercontent.com/u/12646771?v=3","gravatar_id":"","url":"https://api.github.com/users/wackerm","html_url":"https://github.com/wackerm","followers_url":"https://api.github.com/users/wackerm/followers","following_url":"https://api.github.com/users/wackerm/following{/other_user}","gists_url":"https://api.github.com/users/wackerm/gists{/gist_id}","starred_url":"https://api.github.com/users/wackerm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wackerm/subscriptions","organizations_url":"https://api.github.com/users/wackerm/orgs","repos_url":"https://api.github.com/users/wackerm/repos","events_url":"https://api.github.com/users/wackerm/events{/privacy}","received_events_url":"https://api.github.com/users/wackerm/received_events","type":"User","site_admin":false},"created_at":"2016-02-22T10:11:09Z","updated_at":"2016-02-22T10:11:09Z","body":"i am not sure, if i fully understood your proposed ratelimit configuration, but as far as i understood this will work only for a specific receiver with domain \"example.com\" or a sender \"...@example.com\"?\r\n\r\nWe are hosting some hundred domains with lots of users, signing in from dynamic IPs... so how to distinguish the users?\r\n\r\nWe just had the case, that a users computer was infected and abused to send thousands of messages a minute while login in with his compromised credentials...\r\n"}}