<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""> I have PFSense too and it rocks! <br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Apr 22, 2020, at 14:52, <a href="mailto:byalefp@yahoo.com.br" class="">byalefp@yahoo.com.br</a> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="auto" class="">Usually I use pfsense as main firewall with snort blocking all kind of scans and others.<div dir="auto" class=""><br class=""></div><div dir="auto" class="">Fail2ban triggering after 3 unsuccessful tries and for last iptables if Linux or ipfw If Freebsd</div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">Keep pfsense synced with intrusion lists is an must have.</div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">And for last, bans are not temporary on my setup, are forever, except if an real user after validate his info / data calls to unblock him.<br class=""><br class=""><div data-smartmail="gmail_signature" dir="auto" class="">There's some guides around about deal with post screen, but never get that working... RBL and spamhaus lists on mail server and on DNS are another must have.</div><div data-smartmail="gmail_signature" dir="auto" class=""><br class=""></div><div data-smartmail="gmail_signature" dir="auto" class="">Good luck<br class=""><br class="">Atenciosamente,<br class=""><br class=""><br class=""><br class=""><br class="">Alexandre Fernandes Pedrosa<br class=""><br class=""><br class="">-------<br class="">Visite: <a href="https://alexandrepedrosa.com" class="">https://alexandrepedrosa.com</a><br class=""><br class=""><br class="">PGP Key: <a href="https://alexandrepedrosa.com/keys/0xE830E3336A873BE6.asc" class="">https://alexandrepedrosa.com/keys/0xE830E3336A873BE6.asc</a><br class=""><br class="">Fingerprint: 4D63 0DEC FDA4 A8D3 DF75 94DB E830 E333 6A87 3BE6 <br class=""><br class=""><br class="">Esta mensagem incluindo seus anexos tem caráter confidencial e seu conteúdo restrito ao destinatário da mensagem. Se você recebeu esta mensagem por engano, queira por favor retornar o e-mail e apagá-la de seus arquivos.<br class=""><br class="">Qualquer uso não autorizado ou disseminação desta mensagem ou parte dela é expressamente proibido.<br class=""><br class=""><br class="">Note: "The contents of this e-mail are confidential and may be privileged.<br class=""><br class="">This e-mail is intended for the exclusive use of the addressee(s) state under.<br class=""><br class="">If you are not the intended addressee, please contact us immediately and delete this message from your computer, you should not copy this e-mail or disclose its contents to any other person."</div></div></div><div class="gmail_extra"><br class=""><div class="gmail_quote">Em 22 de abr de 2020 09:29, Johannes Rohr <<a href="mailto:johannes@rohr.org" class="">johannes@rohr.org</a>> escreveu:<br type="attribution" class=""><blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr" class="">Dear all,
<br class="">
<br class="">
what are the key strategies for intrusion prevention and detection with
<br class="">
dovecot, apart from installing fail2ban?
<br class="">
It is a pity that the IMAP protocol does not support 2 factor
<br class="">
authentication, which seems to stop 90% of intrusion attempts in their
<br class="">
tracks. Without it, if someone has obtained your password and reads your
<br class="">
mail without modifying it, you will hardly ever notice.
<br class="">
<br class="">
Is there a reasonable way of detecting and preventing logins from
<br class="">
unusual IP ranges? Or are there other strategies you would recommend?
<br class="">
<br class="">
Cheers,
<br class="">
<br class="">
Johannes
<br class="">
<br class="">
<br class="">
</p>
</blockquote></div><br class=""></div></div></blockquote></div><br class=""></body></html>