> I am still having problems with these brute force attacks, the problem seems
> to be that dovecot is spawing too many processes->PAM requests before the
> intrusion detection progam has notices. Is there a way to hard code the
> number of simultaneous running dovecot processes to give time for the
> blocking scripts to respond. Something like 50 dovcot pop3-login processes
> at once should be heaps.
I can't post details at the moment but another alternative is a good
iptables firewall for your boxes that use the recent module as you can
literally block an attack like this on the fourth connection.
See post coba-e:09907 in the archives for details.
Dan