-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Fri, 6 Nov 2009, Timo Sirainen wrote:
Any thoughts?
The only two remarks I have are that some well-known IPs should be able to bypass this check, e.g. NATed gateways of the organisation and that external IDSs (e.g. fail2ban) should be able to pick up the possible breakin, maybe you can configure Dovecot to send failed logins to syslog, too, even though it logs to file normally.
My subjective feeling is that such "hammering" attacks from a single host origin from a misconfigured auto-POPer than an attack nowadays.
Regards,
Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBSvfMdXWSIuGy1ktrAQLKTAf/e7cQ6ONK0HuqkBeg3NBotXsRf0qeeOmZ w857YOQJqqGVrnCBQVaA7OWVBlAMhfpM3Nc/WMth4/vooXz8wWp3Y+Bqpw1Iex1M qOI2nIX+Jep4a8/3XExmWlh5gsQRWQRhkWNY12nu2jqEe0QT4VgqrMIs7YPgXTel fmWSWHA3HySKiRbP+pwzPZH1B6aEAysK3W/BHycS5/HWab4E60LiyncBtMm24eKZ dRZ1NqOhknNX8E6lbnNagQL/J1Cnge1drT0/FvYNunuMPpgWVopBw73sifC/Xh9A RhOIjcw56MN0CNvJBBW692FGNMjiSanHJztLb/1iop8LT4+bmvrWvA== =W9T5 -----END PGP SIGNATURE-----