-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Fri, 6 Nov 2009, Timo Sirainen wrote:
Any thoughts?
The only two remarks I have are that some well-known IPs should be able to
bypass this check, e.g. NATed gateways of the organisation and that
external IDSs (e.g. fail2ban) should be able to pick up the possible
breakin, maybe you can configure Dovecot to send failed logins to syslog,
too, even though it logs to file normally.
My subjective feeling is that such "hammering" attacks from a single host
origin from a misconfigured auto-POPer than an attack nowadays.
Regards,
- --
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBSvfMdXWSIuGy1ktrAQLKTAf/e7cQ6ONK0HuqkBeg3NBotXsRf0qeeOmZ
w857YOQJqqGVrnCBQVaA7OWVBlAMhfpM3Nc/WMth4/vooXz8wWp3Y+Bqpw1Iex1M
qOI2nIX+Jep4a8/3XExmWlh5gsQRWQRhkWNY12nu2jqEe0QT4VgqrMIs7YPgXTel
fmWSWHA3HySKiRbP+pwzPZH1B6aEAysK3W/BHycS5/HWab4E60LiyncBtMm24eKZ
dRZ1NqOhknNX8E6lbnNagQL/J1Cnge1drT0/FvYNunuMPpgWVopBw73sifC/Xh9A
RhOIjcw56MN0CNvJBBW692FGNMjiSanHJztLb/1iop8LT4+bmvrWvA==
=W9T5
-----END PGP SIGNATURE-----
