<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">Am 11.04.2019 um 12:43 schrieb Marc Roos via dovecot <<a href="mailto:dovecot@dovecot.org" class="">dovecot@dovecot.org</a>>:</div><br class="Apple-interchange-newline"><div class=""><div class="">Please do not assume anything other than what is written, it is a <br class="">hypothetical situation<br class=""><br class=""><br class="">A. With the fail2ban solution<br class=""> - you 'solve' that the current ip is not able to access you<br class=""> - it will continue bothering other servers and admins<br class=""> - you get the next abuse host to give a try.<br class=""><br class="">B. With 500GB dump<br class=""> - the owner of the attacking server (probably hacked) will notice it <br class="">will be forced to take action.<br class=""><br class=""><br class="">If abuse clouds are smart (most are) they would notice that attacking my <br class="">servers, will result in the loss of abuse nodes, hence they will not <br class="">bother me anymore. <br class=""><br class="">If every one would apply strategy B, the abuse problem would get less. <br class="">Don't you agree??<br class=""></div></div></blockquote><div><br class=""></div><div>I disagree. If 100 servers "hack" your imap account and fetch 500GB then</div><div>most likely your server is unreachable. If this is done over many servers</div><div>then your rack switches become the bottleneck and uninvolved servers are</div><div>affected too.</div><div><br class=""></div><div>Your solution may work if traffic is expensive and limited but we're heading</div><div>in the other direction: you can rent a server for 50 bucks with 1gbit bandwidth</div><div>and unmetered traffic e.g. at <a href="http://hetzner.de" class="">hetzner.de</a></div><div><br class=""></div><div>Maybe you want to look into a solution like weakforced:</div><div><br class=""></div><div><a href="https://github.com/PowerDNS/weakforced" class="">https://github.com/PowerDNS/weakforced</a></div><div>Wforce is a project by Dovecot, PowerDNS and Open-Xchange</div><div><br class=""></div><div>Best regards</div><div>Gerald</div><div><br class=""></div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class="">-----Original Message-----<br class="">From: Odhiambo Washington <br class="">Sent: donderdag 11 april 2019 12:28<br class="">To: Marc Roos<br class="">Cc: dovecot<br class="">Subject: Re: Mail account brute force / harassment<br class=""><br class=""><br class=""><br class="">On Thu, 11 Apr 2019 at 13:24, Marc Roos via dovecot <br class=""><<a href="mailto:dovecot@dovecot.org" class="">dovecot@dovecot.org</a>> wrote:<br class=""><br class=""><br class=""><br class=""><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>Say for instance you have some one trying to constantly access an <br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>account<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>Has any of you made something creative like this:<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>* configure that account to allow to login with any password<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>* link that account to something like /dev/zero that generates <br class="">infinite <br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>amount of messages<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span> (maybe send an archive of virusses?)<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>* transferring TB's of data to this harassing client.<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>I think it would be interesting to be able to do such a thing.<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span><br class=""><br class=""><br class="">Instead of being evil, just use fail2ban to address this problem :-) <br class=""><br class="">-- <br class=""><br class="">Best regards,<br class="">Odhiambo WASHINGTON,<br class="">Nairobi,KE<br class="">+254 7 3200 0004/+254 7 2274 3223<br class="">"Oh, the cruft.", grep ^[^#] :-)<br class=""><br class=""><br class=""></div></div></blockquote></div><br class=""></body></html>