Blocking of IP addresses trying to login

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
mfehr
Advanced member
Advanced member
Posts: 64
Joined: Fri Sep 12, 2014 11:25 pm

Blocking of IP addresses trying to login

Postby mfehr » Fri Apr 26, 2019 7:59 pm

I regularly face situations where some accounts change into a lockout mode due to external servers trying to login guessing passwords. While the lockout prevents the attacker to run many password attempts, the affected user is frustrated as he is not able to login anymore until his account is unlocked again.

Is there a way to identify and block the IP address where the failed attempts are coming from as well as raise an alert via mail and clear identification in a log file?

What is best practice to block repeated failed logins?


phoenix
Ambassador
Ambassador
Posts: 26325
Joined: Fri Sep 12, 2014 9:56 pm
Location: Liverpool, England

Re: Blocking of IP addresses trying to login

Postby phoenix » Sat Apr 27, 2019 11:25 am

How about searching the forums and wiki on how to configure fail2ban to achieve a solution?
Regards

Bill

Rspamd: A high performance spamassassin replacement

If you'd like to see this implemented in a future version of ZCS then please vote on Bugzilla entries 97706 & 108168
mfehr
Advanced member
Advanced member
Posts: 64
Joined: Fri Sep 12, 2014 11:25 pm

Re: Blocking of IP addresses trying to login

Postby mfehr » Fri May 03, 2019 5:27 pm

Great hint. Fail2ban looks very promising. I'll give it a try.

Return to “Administrators”

Who is online

Users browsing this forum: Google [Bot], MSN [Bot] and 14 guests