Re: [Dovecot] Delay on failed pw attempts

On Tue, 1 Jan 2008, Dean Brooks wrote:

Hi,

Is there a way, or can a way be added, to add an "auth_failed_delay=10s" style option that would put in an artificial delay after a failed password attempt?

As it stands now, Dovecot seems highly vulnerable to widescale brute-force password dictionary scans.

But not if you secure access to Dovecot using e.g. fail2ban. Why is adding complexity to Dovecot better than using a dedicated tool?

-- Asheesh.

-- Kites rise highest against the wind -- not with it. -- Winston Churchill