Date: Sun, 24 Mar 2013 09:27:05 -0400 From: Lowell Gilbert <freebsd-questions-local@be-well.ilk.org> To: Doug Hardie <bc979@lafn.org> Cc: "freebsd-questions@freebsd.org List" <freebsd-questions@freebsd.org> Subject: Re: Client Authentication Message-ID: <44d2upylli.fsf@lowell-desk.lan> In-Reply-To: <8680FAB3-4943-4F91-935B-E11511C3FD4E@lafn.org> (Doug Hardie's message of "Sat, 23 Mar 2013 22:16:37 -0700") References: <B2DC7342-9F1A-489A-94F0-49802B1E5DF6@lafn.org> <CAOgwaMvu%2BOC4PiPfNNwoj7aB%2B631Nt_=SwjFG9y89%2BavB6Mp9Q@mail.gmail.com> <8680FAB3-4943-4F91-935B-E11511C3FD4E@lafn.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Doug Hardie <bc979@lafn.org> writes: > That is an interesting idea, but unfortunately our users tend to > travel a lot and need to be able to access mail from anywhere. Also, > static IPs can get quite expensive from some ISPs. Our users are > pretty much on fixed incomes and any expense is a hardship for them. I've been thinking about setting up certificates for pretty much the same reason, but I haven't gotten around to it yet. My standing impression is that the setup is mostly specific to the mail server, which in my case is currently dovecot. Regardless of what else you do, there are some defensive things you could do to take some of the pressure off. They won't be a solution, but they might make your life easier while you work on a solution. Port knocking would make it harder for the attackers to get through to try passwords, and it's fairly easy to install on any particular type of client. With the variety of clients you have to deal with, the cumulative effort may be overwhelming, but it's at least worth a thought. Another thing to try would be temporarily blocking any IP address that tries several different user names in a short period of time. Again, these kinds of things won't solve your problem, but they may reduce the intensity of the attack. Good luck.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?44d2upylli.fsf>