Date:  Fri, 01 Aug 2008 14:41:27 +1000
From:  Greg Kuhnert <greg.kuhnert (at mark) theanchoragesylvania.com>
Subject:  [coba-e:13672] Re: Dovecot/POP3 Flood
To:  User Ernie <ernie (at mark) info.eis.net.au>
Cc:  coba-e (at mark) bluequartz.org
Message-Id:  <489293F7.6070801 (at mark) theanchoragesylvania.com>
In-Reply-To:  <200807310015.m6V0FS7S049132 (at mark) info.eis.net.au>
References:  <200807310015.m6V0FS7S049132 (at mark) info.eis.net.au>
X-Mail-Count: 13672

There is a link from the other "dfix" page to another module that will 
help you out :)

http://www.gregkuhnert.com/public:bq:denyhosts

Regards,
Greg

User Ernie wrote:
> On a similar topic, does anyone know of a script that will block brute force
> attacks on the ssh port?
>
> - Ernie.
>
>
>   
>> ----- Original Message ----- 
>> From: "Robert Fitzpatrick" <lists (at mark) webtent.net>
>> To: "BlueQuartz" <coba-e (at mark) bluequartz.org>
>> Sent: Tuesday, July 22, 2008 6:57 PM
>> Subject: [coba-e:13590] Dovecot/POP3 Flood
>>
>>
>>     
>>> I've seen some talk about Dovecot repeating password prompts on the list
>>> and while this happens to us from time to time, the procedure for
>>> restarting some things along with dbrecover always seems to work.
>>> Tonight I had two servers do it at the same time, so I'm assuming a
>>> flood/attack of some sort?
>>>
>>> Is there any recommended way or dovecot settings to avoid this from
>>> happening?
>>>
>>> -- 
>>>       
>> Robert
>>
>>
>> I think you need to install software that will check for brute force attacks 
>> and block that IP.
>>
>> Then also the flat file conversion is a very good idea.
>>
>>
>> ----
>> Ken Marcus
>> Ecommerce Web Hosting by
>> Precision Web Hosting, Inc.
>> http://www.precisionweb.net
>>
>>
>>
>>
>>
>>     
>
>