[BlueOnyx:04412] Re: can't stop this attack

[Dudi Goldenberg]

> maillog looks like this
> 
> May  6 11:43:44 ns1 dovecot: pop3-login: Disconnected (auth failed, 1
> attempts): user=<Krystal>, method=PLAIN, rip=213.80.73.45,
> lip=70.246.22.22
> May  6 11:43:44 ns1 dovecot: pop3-login: Disconnected (auth failed, 1
> attempts): user=<Patches>, method=PLAIN, rip=213.80.73.45,
> lip=70.246.22.28
> May  6 11:43:44 ns1 dovecot: pop3-login: Disconnected (auth failed, 1
> attempts): user=<Maveric>, method=PLAIN, rip=213.80.73.45,
> lip=70.246.22.42
> May  6 11:43:45 ns1 dovecot: pop3-login: Disconnected (auth failed, 1
> attempts): user=<Merlin>, method=PLAIN, rip=213.80.73.45,
> lip=70.246.22.21
> 
> ideas?

Why not install fail2ban?

Does wonders on my servers for dovecot pop3, imap and sasl, plus ftp and
ssh.

Regards,

D.