Re: [Dovecot] Under POP attack - now to prevent?

James Brown wrote:

Jun 5 11:48:32 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<atlanta>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9

Any suggestions on how to prevent this?

Using Dovecot 1.2RC4

Route that address to localhost? Works here :)

There are various automated tools, like fail2ban, which can help with this -- if you're using a setup they can hook into.

-- Curtis Maloney cmaloney@cardgate.net