[Dovecot] Under POP attack - now to prevent?

[Curtis Maloney]

James Brown wrote:
> Jun  5 11:48:32 mail dovecot[2620]: pop3-login: Aborted login (auth 
> failed, 1 attempts): user=<atlanta>, method=PLAIN, rip=85.189.169.94, 
> lip=192.168.1.9
> 
> Any suggestions on how to prevent this?
> 
> Using Dovecot 1.2RC4

Route that address to localhost?  Works here :)

There are various automated tools, like fail2ban, which can help with this 
-- if you're using a setup they can hook into.

-- 
Curtis Maloney
cmaloney at cardgate.net