Date:  Wed, 12 Aug 2009 16:13:17 -0500
From:  Tom W <midintertech (at mark) hotmail.com>
Subject:  [coba-e:15879] Re: Block Hacker IP from BQ and BX Server
To:  "coba-e (at mark) bluequartz.org" <coba-e (at mark) bluequartz.org>
Message-Id:  <BAY107-W32D44D258333B9D55E5716D1040 (at mark) phx.gbl>
In-Reply-To:  <C81E2DF7ABD74911BB472BEC43ABD0A2@HP9925NR>
References:  <2DAB4EF3-1B30-4A80-9B28-05C1CAC2B271 (at mark) housleyconsulting.com.au> <BAY107-W428D49C8AE2A6E64E87003D1070 (at mark) phx.gbl> <C81E2DF7ABD74911BB472BEC43ABD0A2 (at mark) HP9925NR>
X-Mail-Count: 15879




----------------------------------------
> Date: Tue, 11 Aug 2009 19:32:20 -0400
> From: dmobley (at mark) uhostme.com
> Subject: [coba-e:15877] Re: Block Hacker IP from BQ and BX Server
> To: coba-e (at mark) bluequartz.org
>
>> -----Original Message-----
>> From: Tom W [mailto:midintertech (at mark) hotmail.com]
>> Sent: Tuesday, August 11, 2009 5:35 PM
>> To: coba-e (at mark) bluequartz.org
>> Subject: [coba-e:15876] Re: Block Hacker IP from BQ and BX Server
>>
>> We have been using dfix.sh for quite awhile and it seems to
>> work pretty good for this also. We have also played with
>> deny.hosts and fail2ban when we needed to block other
>> types of services. But if you just need something for dovecot
>> dfix works pretty good, I think it watchs/blocks a few other
>> type attacks also. Good Luck!
>
> I've been using DFix as well, but the other day I got an POP3 attack that
> DFix did nothing with. Isn't DFix supposed to address that sort of attack?
>
>

Are you using the latest version?? I think there was
a change in a dovecot update awhile back that changed
the way dovecot puts stuff in logfiles so there was an
update to dfix I believe.


http://bluequartz.org/ml/archive/coba-e/15800/15825.html




_________________________________________________________________
Get back to school stuff for them and cashback for you.
http://www.bing.com/cashback?form=MSHYCB&publ=WLHMTAG&crea=TEXT_MSHYCB_BackToSchool_Cashback_BTSCashback_1x1