[
https://issues.apache.org/jira/browse/JAMES-1723?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15249711#comment-15249711
]
Alexei Osipov commented on JAMES-1723:
--------------------------------------
I use James 3.x (built from sources) and I can see IP of an attacker in logs.
It's just sad I can't do anything with that using built-in tools that James has.
> Add protection from password bruteforcing
> -----------------------------------------
>
> Key: JAMES-1723
> URL: https://issues.apache.org/jira/browse/JAMES-1723
> Project: James Server
> Issue Type: New Feature
> Affects Versions: Trunk, 3.0-beta4, 3.0.0-beta5
> Reporter: Alexei Osipov
>
> Right now James has no mechanisms of protection against password forcing.
> For example, it's possible to connect to James via SMTP and execute AUTH
> command as many times as needed to guess user's password.
> Common practices that may be used by James:
> 1) Force disconnect after few unsuccessful AUTH requests.
> 2) Count failed AUTH requests by IP address and reject connections from that
> IP if number of failures reached some threshold.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
