Re: [Dovecot] IP Tables block for POP3 attacks with Dovecot

2007-04-08 Thread David McBride
Sean Kamath wrote: Gotta love PF on OpenBSD (and FreeBSD). It was a simple addition to the pass rule: Linux iptables has a similar facility. See the 'RECENT' iptables module: http://www.debian-administration.org/articles/187 Be aware that older Linux kernel's RECENT implementation

Re: [Dovecot] IP Tables block for POP3 attacks with Dovecot

2007-04-08 Thread Sean Kamath
On Apr 8, 2007, at 9:20 AM, Pete Dubler wrote: Has anyone implemented a script to block IPs which are attacking on POP3 ports using dovecot logs to indicate repetitive failed login attempts? sshblack does this nicely for ssh (port 22) attacks by monitoring the /var/log/secure file. I am

Re: [Dovecot] IP Tables block for POP3 attacks with Dovecot

2007-04-08 Thread Charles Marcus
Pete Dubler wrote: Has anyone implemented a script to block IPs which are attacking on POP3 ports using dovecot logs to indicate repetitive failed login attempts? Have you heard of Fail2ban? http://www.fail2ban.org/wiki/index.php/Main_Page It may do what you want... -- Best regards, Charle