Re: is it possible to lockout failed authenticators

Thanks... a lot of folks have been pointing that way.

Miles

Richard Westlake wrote:
> Hi Miles
> I am not sure that imapd or Perdition (Mail Retrieval Proxy) can rate 
> limit password guesses or block accounts on repeated failure.
>
> You could have a look at tools such as Fail2ban 
> http://www.fail2ban.org/wiki/index.php/Main_Page which could help 
> protect against future brute force attaches.
>
>
> I would be interested to learn what solution you do find.
>
> All the best
>
>
> Richard Westlake
> Department of Biological Sciences, Birkbeck College, Malet Street, 
> London WC1E 7HX
> Tel: +44 (0)20-7631-6859
> ----------------------------------------------------------------------
>                Truth endures but spelling changes    --  Anon.
> ----------------------------------------------------------------------
>
>
> On Sun, 3 Mar 2013, Miles Fidelman wrote:
>
>> Date: Sun, 03 Mar 2013 08:11:28 -0500
>> From: Miles Fidelman <[email protected]>
>> To: [email protected]
>> Subject: [Imap-uw] is it possible to lockout failed authenticators
>>
>> Hi Folks,
>>
>> One of our users recently had her password compromised, and 
>> subsequently had a bunch of spam sent through her email account.  It 
>> looks to me, like the compromised was the result of a weak password, 
>> coupled with brute force cracking attempts against both our imap and 
>> smtp servers (at least there are a LOT of failed authentication 
>> attempts logged).
>>
>> Which has led me to wonder:  For human logins, its standard practice 
>> to lock an account after some number of failed attempts - at least 
>> for a few minutes, if not until someone intervenes. What with 
>> computers being a LOT faster than humans, it occurs to me to wonder 
>> whether there's an easy way to set imapd to lock out specific 
>> IP/username combinations after some number of failed authentication 
>> attempts.
>>
>> Suggestions?
>>
>> Thanks very much,
>>
>> Miles Fidelman
>>
>> -- 
>> In theory, there is no difference between theory and practice.
>> In practice, there is.   .... Yogi Berra
>>
>> _______________________________________________
>> Imap-uw mailing list
>> [email protected]
>> http://mailman2.u.washington.edu/mailman/listinfo/imap-uw
>>