[BlueOnyx:04421] Re: can't stop this attack

[Jeff Folk]

On May 6, 2010, at 4:40 PM, Dudi Goldenberg wrote:

> Hi,
>
>> I don't think that will work
>> the server has about 250 IP address and probably 750 users.
>> The attack uses a different user name and a different IP
>>
>> possibly hit the 2nd user in a couple of days
>
> fail2ban should still work.
>
> It count authentication failures per given time periods.
>
> Your log snip shows several attempts from the same IP, it would
> definitely be caught.
>
> One of my servers (a BQ) has half the IPs but double the users and
> fail2ban works wonders there.
>
> Regards,
>
> D.

Fail2Ban doesn't block these (dovecot failed logins) for me, but dFix  
does.

Jeff