[BlueOnyx:16786] Re: Dovecot security

[Michael Stauber]

Hi Robert,

> I have a customer that starts receiving 'auth failed' when checking any 
> mailboxes from their office location, I have verified all logins are 
> correct using Webmail. I found an error in our maillog related to one 
> specific user receiving the following error.....
> 
> Dec 31 09:24:09 www1 dovecot: imap-login: Disconnected: Too many invalid 
> commands (auth failed, 1 attempts in 6 secs): user=...

We're using a pretty much stock Dovecot 2.2 configuration. The only
changes are related to allowed SSL ciphers and protocols and the mailbox
format and location.

Dovecot 2.2 (we're using 2.2.15) has some built in auth penalty that
kicks in if there are repeated false authentications from a given source
or user.

More information on how that works can be found here:

http://wiki2.dovecot.org/Authentication/Penalty
http://wiki2.dovecot.org/Authentication

-- 
With best regards

Michael Stauber