Hi new to the list, but we are a long time user of Dovecot via DirectAdmin control panel.

We, like everyone else, are seeing an increase in dictionary attacks of POP/IMAP. We want to block them.

I've searched the mailing list and found a few recommended fail2ban, which really won't work for our case. We need to do this over many machines and not one or two. We also like to gather info at the network wide level. Hackers know about attacking specific server/ips too often and we've seen much more distributed attacks that go under the radar of one server monitoring setup.

We've designed our own system and use a local RBL to distribute the blocked IPs. For ftp and ssh attacks it's worked very well. We would like to use the RBL to do the same with dovecot.

From my research it appears the best way to do this (and only currently) is with the checkpassword option. I haven't gotten it to work yet. We have:

    passdb checkpassword {
            args = /usr/local/bin/checkpassword 
            deny = yes
    }

As the first auth.. This should reject the connection if the IP matches. checkpassword can see TCPREMOTEIP enviornmental variable.

In the checkpassword script we have:

#!/usr/bin/perl

sub read_uinfo { my($user,$passwd,$apop_ts); open X,"<&=3" or exit 111; $_ = <X>; # ugly; should use sysread instead ($user,$passwd,$apop_ts) = /^(.*)\0(.*)\0(.*)\0/; while (<X>) {}; close X; return ($user,$passwd,$apop_ts); }

($user,$passwd,$apop_ts)=$debug?(shift,shift,shift):read_uinfo;

$ipaddr=$ENV{TCPREMOTEIP}; $result=system("/usr/sbin/checkdnsbl $ipaddr"); if ( $result == 0) { @ENV{"SHELL","USER","HOME"} = ($shell,$user,$home); exit 0; } else { exit 1; }

My questions are as follows:

• Can the deny = yes be used with checkpassword?
• What am I doing wrong with the script? It should reject only the connections that are in the RBL. It blocks all

-L

-- Larry Ludwig Empowering Media 1-866-792-0489 x600 Managed and Unmanaged Xen VPSes http://www.hostcube.com/