Re: [Dovecot] dnsbl feature for dovecot

2013-07-04 Thread Robert Schetterer
Am 03.07.2013 20:53, schrieb Reindl Harald: Am 03.07.2013 20:41, schrieb John Fawcett: On 03/07/13 18:40, Benny Pedersen wrote: John Fawcett skrev den 2013-07-03 03:21: dnsbl's are a popular method to prevent listed ips from making connections to mta software. hmm are pop3/imap clients

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Robert Schetterer
Am 03.07.2013 04:11, schrieb Stan Hoeppner: On 7/2/2013 8:32 PM, Professa Dementia wrote: On 7/2/2013 6:21 PM, John Fawcett wrote: dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf. postscreen_dnsbl_sites in postfix Would it be possible to

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread John Fawcett
On 03/07/13 05:24, Professa Dementia wrote: On 7/2/2013 7:11 PM, Stan Hoeppner wrote: On 7/2/2013 8:32 PM, Professa Dementia wrote: On 7/2/2013 6:21 PM, John Fawcett wrote: dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf. postscreen_dnsbl_sites

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Robert Schetterer
Am 03.07.2013 05:24, schrieb Professa Dementia: On 7/2/2013 7:11 PM, Stan Hoeppner wrote: On 7/2/2013 8:32 PM, Professa Dementia wrote: On 7/2/2013 6:21 PM, John Fawcett wrote: dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf.

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread John Fawcett
On 03/07/13 09:26, Robert Schetterer wrote: Am 03.07.2013 04:11, schrieb Stan Hoeppner: On 7/2/2013 8:32 PM, Professa Dementia wrote: On 7/2/2013 6:21 PM, John Fawcett wrote: dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf.

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread John Fawcett
On 03/07/13 03:27, Timo Sirainen wrote: On 3.7.2013, at 4.21, John Fawcett john...@erba.tv wrote: dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf. postscreen_dnsbl_sites in postfix Would it be possible to introduce such a feature in dovecot,

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Branko Majic
On Wed, 03 Jul 2013 09:37:14 +0200 Robert Schetterer r...@sys4.de wrote: Am 03.07.2013 05:24, schrieb Professa Dementia: On 7/2/2013 7:11 PM, Stan Hoeppner wrote: On 7/2/2013 8:32 PM, Professa Dementia wrote: On 7/2/2013 6:21 PM, John Fawcett wrote: dnsbl's are a popular method to

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Professa Dementia
On 7/3/2013 12:35 AM, John Fawcett wrote: The point is to stop spambot connections to pop and imap (which are usually done to try and steal credentials). This is not the usual way spambots work. Generally, spambots scrape addresses from various sources in order to get lists of emails to send

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Benny Pedersen
John Fawcett skrev den 2013-07-03 03:21: dnsbl's are a popular method to prevent listed ips from making connections to mta software. hmm are pop3/imap clients not authed users ? well done -- senders that put my email into body content will deliver it to my own trashcan, so if you like to

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Benny Pedersen
Timo Sirainen skrev den 2013-07-03 03:27: You're talking about IMAP/POP3 connections? Possible, yeah .. possibly even without code changes by using tcpwrappers. why is it needed ? setup fail2ban to manange xtables-addons geoip csv files from abusers, then use this csv file as A0 list in

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Benny Pedersen
John Fawcett skrev den 2013-07-03 09:40: Possible, yeah .. possibly even without code changes by using tcpwrappers. TImo, thanks for the reply. I will look into that suggestion. John if its implemented in dovecot possible use postfix memcached ?, so thay share cache data -- senders that

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread John Fawcett
On 03/07/13 18:44, Benny Pedersen wrote: Timo Sirainen skrev den 2013-07-03 03:27: You're talking about IMAP/POP3 connections? Possible, yeah .. possibly even without code changes by using tcpwrappers. why is it needed ? setup fail2ban to manange xtables-addons geoip csv files from

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread John Fawcett
On 03/07/13 18:40, Benny Pedersen wrote: John Fawcett skrev den 2013-07-03 03:21: dnsbl's are a popular method to prevent listed ips from making connections to mta software. hmm are pop3/imap clients not authed users ? well done in this case no, I am talking about connections from zombies.

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Benny Pedersen
John Fawcett skrev den 2013-07-03 20:41: in this case no, I am talking about connections from zombies. block client ip of the zombies, this is what iptables is for, or change rules to only have ports open for clients location, well dovecot supports ipblocking, but imho its not the right

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Reindl Harald
Am 03.07.2013 20:41, schrieb John Fawcett: On 03/07/13 18:40, Benny Pedersen wrote: John Fawcett skrev den 2013-07-03 03:21: dnsbl's are a popular method to prevent listed ips from making connections to mta software. hmm are pop3/imap clients not authed users ? well done in this case

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread John Fawcett
On 03/07/13 12:47, Professa Dementia wrote: On 7/3/2013 12:35 AM, John Fawcett wrote: The point is to stop spambot connections to pop and imap (which are usually done to try and steal credentials). This is not the usual way spambots work. Generally, spambots scrape addresses from various

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Joseph Tam
Professa Dementia writes: 2) Fail2Ban with rules that seem like they are pretty weak, but trust me, they work fine and you limit complaints from users. a) If you get 3 invalid login attempts within a minute from more than 1 IP address, block that login for 10 minutes. If you have blocked a

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Professa Dementia
On 7/3/2013 2:30 PM, Joseph Tam wrote: Brute force attempts are more intense, so I think these rules can be set harder to not risk plunking your users into blacklist hell. Also, some common role account (that don't exist on my system e.g. admin) will trigger an immediate blacklist here -- an

[Dovecot] dnsbl feature for dovecot

2013-07-02 Thread John Fawcett
dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf. postscreen_dnsbl_sites in postfix Would it be possible to introduce such a feature in dovecot, so that connections can be denied based on a dnsbl lookup (where the precise dnsbls used are

Re: [Dovecot] dnsbl feature for dovecot

2013-07-02 Thread Timo Sirainen
On 3.7.2013, at 4.21, John Fawcett john...@erba.tv wrote: dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf. postscreen_dnsbl_sites in postfix Would it be possible to introduce such a feature in dovecot, so that connections can be denied

Re: [Dovecot] dnsbl feature for dovecot

2013-07-02 Thread Professa Dementia
On 7/2/2013 6:21 PM, John Fawcett wrote: dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf. postscreen_dnsbl_sites in postfix Would it be possible to introduce such a feature in dovecot, so that connections can be denied based on a dnsbl

Re: [Dovecot] dnsbl feature for dovecot

2013-07-02 Thread Stan Hoeppner
On 7/2/2013 8:32 PM, Professa Dementia wrote: On 7/2/2013 6:21 PM, John Fawcett wrote: dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf. postscreen_dnsbl_sites in postfix Would it be possible to introduce such a feature in dovecot, so that

Re: [Dovecot] dnsbl feature for dovecot

2013-07-02 Thread Professa Dementia
On 7/2/2013 7:11 PM, Stan Hoeppner wrote: On 7/2/2013 8:32 PM, Professa Dementia wrote: On 7/2/2013 6:21 PM, John Fawcett wrote: dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf. postscreen_dnsbl_sites in postfix Would it be possible to