Re: [Dovecot] last login timestamp

2013-04-29 Thread Julio Cesar Covolato 

Em 29/04/2013 14:54, Robert Schetterer escreveu:

Am 29.04.2013 19:14, schrieb oaj...@frsf.utn.edu.ar:

I guess I don't have such a high load so I will try Peer's
recomendation about using PostLoginScripting first and measure the
impact. I will try the log monitoring technique if the impact is
significant. Thank you very much.

for low/middle traffic  servers PostLoginScripting touch method as
described in the dove wiki is absolut ok, i decide changing it ,about
getting over 1000 logins per second on a 4000 Users systems loadbalanced

Best Regards
MfG Robert Schetterer


Hi.

My aproach is just find the oldest message in the folder 
mailbase/domain/user/Maildir/new/ for every user once a day. If there 
are message older then 90 days, put in an on-hold dir compressed archive 
and block all messages to that user, if not claimed in 180 days delete all.


There are a simple shell script that i made whith mysql backend (iredmail):

http://www.psi.com.br/~julio/postfix/MailUserOld.sh.

Regards,

--
-
_Julio Cesar Covolato
   0v0 ju...@psi.com.br
  /(_)\  F: 55-11-3129-3366
   ^ ^   PSI INTERNET
-

Re: [Dovecot] script to detect dictionary attacks

2013-04-09 Thread Julio Cesar Covolato 

Hi Reindl.

I have a similar script to detect brute force attacs to dovecot sasl 
auth sistem, it's very simple to adapt to pop/imap failures log:


http://psi.com.br/~julio/postfix/sasl-killer.sh

Regards,

--
-
_Julio Cesar Covolato
   0v0   ju...@psi.com.br
  /(_)\  F: 55-11-3129-3366
   ^ ^   PSI INTERNET
-

Em 06-04-2013 08:18, Reindl Harald escreveu:

Hi

has someone a script which can filter out dictionary attacks
from /var/log/maillog and notify about the source-IPs?

i know about fail2ban and so on, but i would like to have
a mail with the IP address for two reasons and avoid fail2ban
at all because it does not match in the way we maintain firewalls

* add the IP to a distributed iptables-block.sh and distribute
   it to any server with a comment and timestamp
* write a abuse-mail to the ISP

[Dovecot] mail spool filesystem

2011-08-17 Thread Julio Cesar Covolato 

Hi!

I´m about to migrate a system whith 5000 accounts whith (~ 500GB) from 
postfix/courier-imap/maildrop/mysql to a new hardware whith 
postfix/dovecot/dovecot/mysql.


 I´ll make a separate partition (raid 1) for the mail spool 
(/var/spool/vmail) and want to now what type of filesystem to use on it 
to increase performance. I read that XFS is a good choice, but is not 
too reliable...


Any sugestions?

Thanks in advance,

--
-
_Julio Cesar Covolato
   0v0ju...@psi.com.br
  /(_)\  F: 55-11-3129-3366
   ^ ^   PSI INTERNET
-