under another kind of attack

Joseph Tam jtam.home at gmail.com
Wed Jul 26 23:01:46 EEST 2017


Olaf Hopp <Olaf.Hopp at kit.edu> wrote:

> And I have a new one just for "unknown user" and here my bantime and findtime
> are much bigger and the retries are just '2'. So here I'm much harsher.
> I'll keep an eye on my logs and maybe some more twaeking is necessary.

Just be careful about typos (like twaeking!): users could simply misspell
their username, or get mixed up with some another account or alias.
This is why I favour targetting known bad accounts, not merely accounts
that don't exist.

Joseph Tam <jtam.home at gmail.com>


More information about the dovecot mailing list