detect suspicious logins

[Aki Tuomi]

> On December 20, 2017 at 12:29 PM Marcus Rueckert <darix at opensu.se> wrote:
> 
> 
> On Tue, 19 Dec 2017 17:13:10 +0000
> Matthew Broadhead <matthew.broadhead at nbmlaw.co.uk> wrote:
> 
> > does anyone know of a linux module (maybe similar to fail2ban) that 
> > could be installed which would monitor email logs (sign ins) and
> > alert the user to any suspicious activity on their account?  i
> > suspect it would need to log geo location, device type and ip address
> > to a database.  it seems like a module like this would be very useful
> > and should exist already?  thanks in advance
> 
> https://github.com/PowerDNS/weakforced
> 
> -- 
>           openSUSE - SUSE Linux is my linux
>               openSUSE is good for you
>                   www.opensuse.org

You could use weakforced with dovecot's auth policy

https://wiki2.dovecot.org/Authentication/Policy

Aki