Security risk of POP3 & IMAP protocols
iane at sussex.ac.uk
Fri Feb 13 10:45:11 EST 2009
--On 13 February 2009 15:30:46 +0000 Alain Williams <addw at phcomp.co.uk>
> [23~On Fri, Feb 13, 2009 at 03:21:06PM +0000, Ian Eiloart wrote:
>> --On 13 February 2009 14:35:43 +0000 Alain Williams <addw at phcomp.co.uk>
>> > That got me thinking ....
>> > I rate limit ssh connections to try to prevent dictionary attacks (3
>> > attempts/3 minutes/IP address). If I were to do the same with IMAP
>> > would that cause problems with some clients, ie are there some clients
>> > that to many connect/disconnects ?
>> Yes. Anything that opens a bunch of mailboxes at the same time might be
>> doing way more than that. You should be measuring "failed attempts", not
> Yes, but I do the rate limiting with iptables (Linux firewall).
> I don't know how to feedback failed attempts to iptables.
Hmm, and for the webmail case, you'd want to do failed attempts per
username per minute, not per IP address. Or, exempt your webmail server.
Apple Mail is a case in point, it checks for new mail in "your INBOX" or
"all of your mailboxes" in parallel. I've seen it open dozens of
connections from a single user, simultaneously.
IT Services, University of Sussex
More information about the Info-cyrus