OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Preventing brute force attacks...

From: Peter H. Coffin (hellsopninehells.com)
Date: Fri Aug 01 2003 - 18:04:36 CDT


On Fri, Aug 01, 2003 at 06:36:51PM +0200, Tony Earnshaw wrote:
> Rob Hutton wrote:
>
> >Is there any built in mechanism for locking out an account for a specified
> >period in the case of an attempt to brute force the password with
> >SMTP-AUTH?
>
> TARPIT CONTROLS, sample-smtpd.cf. Was one of the first things I had to
> get working :)

Firewalling the offending IP for a week or two tends to get the message
across as well.

--
"This place is evil! We need weapons! Crossbows! Rocket Launchers!
Rent-a-zilla!"
                 -- L33t Master Largo www.megatokyo.com