Thanks... a lot of folks have been pointing that way.
Miles
Richard Westlake wrote:
Hi Miles
I am not sure that imapd or Perdition (Mail Retrieval Proxy) can rate
limit password guesses or block accounts on repeated failure.
You could have a look at tools such as Fail2ban
http://www.fail2ban.org/wiki/index.php/Main_Page which could help
protect against future brute force attaches.
I would be interested to learn what solution you do find.
All the best
Richard Westlake
Department of Biological Sciences, Birkbeck College, Malet Street,
London WC1E 7HX
Tel: +44 (0)20-7631-6859
----------------------------------------------------------------------
Truth endures but spelling changes -- Anon.
----------------------------------------------------------------------
On Sun, 3 Mar 2013, Miles Fidelman wrote:
Date: Sun, 03 Mar 2013 08:11:28 -0500
From: Miles Fidelman <mfidel...@meetinghouse.net>
To: imap-uw@u.washington.edu
Subject: [Imap-uw] is it possible to lockout failed authenticators
Hi Folks,
One of our users recently had her password compromised, and
subsequently had a bunch of spam sent through her email account. It
looks to me, like the compromised was the result of a weak password,
coupled with brute force cracking attempts against both our imap and
smtp servers (at least there are a LOT of failed authentication
attempts logged).
Which has led me to wonder: For human logins, its standard practice
to lock an account after some number of failed attempts - at least
for a few minutes, if not until someone intervenes. What with
computers being a LOT faster than humans, it occurs to me to wonder
whether there's an easy way to set imapd to lock out specific
IP/username combinations after some number of failed authentication
attempts.
Suggestions?
Thanks very much,
Miles Fidelman
--
In theory, there is no difference between theory and practice.
In practice, there is. .... Yogi Berra
_______________________________________________
Imap-uw mailing list
Imap-uw@u.washington.edu
http://mailman2.u.washington.edu/mailman/listinfo/imap-uw
--
In theory, there is no difference between theory and practice.
In practice, there is. .... Yogi Berra
_______________________________________________
Imap-uw mailing list
Imap-uw@u.washington.edu
http://mailman2.u.washington.edu/mailman/listinfo/imap-uw
