<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
-------- Original Message --------<br>
Subject: Re: cyrus pop3 question<br>
From: Jorey Bump <a class="moz-txt-link-rfc2396E" href="mailto:list@joreybump.com"><list@joreybump.com></a><br>
To: Corey <a class="moz-txt-link-rfc2396E" href="mailto:corey_s@qwest.net"><corey_s@qwest.net></a><br>
Date: Wednesday, April 16, 2008 4:18:58 PM<br>
<blockquote cite="mid:48066D42.1000001@joreybump.com" type="cite">
<pre wrap="">Corey wrote, at 04/16/2008 04:29 PM:
</pre>
<blockquote type="cite">
<pre wrap="">I just had an experience where my server was getting slammed with thousands
of concurrent pop3 requests. This went on for over an hour before it finally
ceased, at which point I was able to start cyrus again.
Anyhow, what are some mechanisms to prevent this in the future?
</pre>
</blockquote>
<pre wrap=""><!---->
I've managed to stop such brute force password attacks by requiring
encryption for all connections in imapd.conf:
sasl_pwcheck_method: auxprop
sasl_mech_list: PLAIN LOGIN CRAM-MD5 DIGEST-MD5
allowplaintext: no
sasl_minimum_layer: 128
Your environment may be different and require some tweaking. Test
thoroughly after making the changes. So far, I've only seen plaintext
brute force attacks against POP3, so maybe it's a limitation of current
malware. Nearly all modern clients can deal with this restriction, and
it's good best practice.
----
Cyrus Home Page: <a class="moz-txt-link-freetext" href="http://cyrusimap.web.cmu.edu/">http://cyrusimap.web.cmu.edu/</a>
Cyrus Wiki/FAQ: <a class="moz-txt-link-freetext" href="http://cyrusimap.web.cmu.edu/twiki">http://cyrusimap.web.cmu.edu/twiki</a>
List Archives/Info: <a class="moz-txt-link-freetext" href="http://asg.web.cmu.edu/cyrus/mailing-list.html">http://asg.web.cmu.edu/cyrus/mailing-list.html</a>
</pre>
</blockquote>
You can rate limit new connections using iptables...
<a class="moz-txt-link-freetext" href="http://www.debian-administration.org/articles/187">http://www.debian-administration.org/articles/187</a> <br>
<br>
I imagine most normal connections are persistent with POP. Some IMAP
clients may not be so nice, notably squirrelmail creates and tears down
an IMAP connection for every user click.<br>
</body>
</html>