Re: POP3 password scanning

[Nick Leverton <nj@leverton.org>]

On Thursday 25 January 2007 22:24, Quinn Comendant wrote:
> There was a robot running on 24.220.50.36 scanning all usernames looking
> for valid user/pass pairs. I thought a good solution to this would be to
> add a configuration to fail2ban (we use it for stopping ssh scanning)
> which will block the IP with iptables if it detects too many failed
> password attempts.
...snips...
> These are md5-digest (I think) password failures, followed by plaintext
> password success. These are all honest valid users, and it is normal.

I know fail2ban has a configureable number of failures before it'll ban the 
IP.  I have it installed but I'm not running it yet :)  Does it reset its 
counter on a successful login ?  If so then just leave maxfailures in 
fail2ban.conf as something greater than 2.

Nick