Re: [mailop] Old users' brute force

2016-02-15 Thread Brandon Long via mailop
Our outgoing pop attempts should back off quite a bit after a while, though I don't think we disable completely. The errors should be visible if they ever log in. I would think that clients should make such login errors fairly prominent. Our intrusion detection system gets the password hash as p

Re: [mailop] Old users' brute force

2016-02-15 Thread Al Iverson
On Mon, Feb 15, 2016 at 4:46 PM, Andreas Schamanek wrote: > Another option would be to send reminders to the users. I haven't done > this yet because I don't feel comfortable to tell them to delete > something. But I just had the idea to compile instructions how to > disable a config and keep it

Re: [mailop] Old users' brute force

2016-02-15 Thread Andreas Schamanek
On Mon, 15 Feb 2016, at 13:45, Al Iverson wrote: > Thus, I don't see this as much of a real issue, to be honest. I agree. Still, I'd prefer some way to convince users to update their configurations. > But if you're looking for ideas on how to ease your personal pain: > You could null route th

Re: [mailop] Old users' brute force

2016-02-15 Thread Jim Dunphy
You might be able to use an ipset with your firewall ... for example ipset create blacklist4hr hash:ip hashsize 4096 timeout 14400 then add something like this into your firewall rules -A INPUT -m set --match-set blacklist4hr src -j DROP then have a program watching the logs based on some thre

Re: [mailop] Old users' brute force

2016-02-15 Thread Kurt Jaeger
Hi! > I was wondering how others deal with failing login attempts related to > deleted accounts. Is there a particularly good way to convince old > users to update their configurations? Re-open the account, feed it hge useless noise and a telling subject/short README. Users will notice and

Re: [mailop] Old users' brute force

2016-02-15 Thread Al Iverson
I run a combination system that uses Google Apps, Gmail accounts, and Fetchmail/scripts to send, receive and process mail for around 400 users. (It's a sort of wanted bulk mail "ham" tracking system, not a personal message platform.) Occasionally somebody changes a password and thus Fetchmail can n

[mailop] Old users' brute force

2016-02-15 Thread Andreas Schamanek
Hi fellow mailops, Often when user's mail accounts get canceled they do not remove or update their MUAs' configuration. Hence, I see a lot of repeated login attempts. Apart from the fact that this is a waste of a number of resources, these attempts also trigger my intrusion detection system (