Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm using csf and noticed a lot of brute force password attempts into a particular pop3 account. csf does not appear to be blocking the IP addresses as it does with other processes. Is there a switch or config option that someone can point me to that instructs csf to block all failed dovecot login attempts?

share|improve this question

1 Answer 1

Have a look at the "SECTION:Login Failure Blocking and Alerts" and set the whished settings.

More specific, LF_POP3D and LF_IMAPD for the amount of attempts before its blocking the IP address.

Furthermore you need to check if the log paths are set correctly.

Go way back down into the config, and see that these settings are correct:

POP3D_LOG =
IMAPD_LOG = 

For me both are /var/log/mail.log, but check your system.

In the file csf/regex.pm you can see which attempts are being filtered.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.