Zimbra Forums

I regularly face situations where some accounts change into a lockout mode due to external servers trying to login guessing passwords. While the lockout prevents the attacker to run many password attempts, the affected user is frustrated as he is not able to login anymore until his account is unlocked again.

Is there a way to identify and block the IP address where the failed attempts are coming from as well as raise an alert via mail and clear identification in a log file?

What is best practice to block repeated failed logins?

How about searching the forums and wiki on how to configure fail2ban to achieve a solution?

Great hint. Fail2ban looks very promising. I'll give it a try.