1 Topic by xvktr

  • xvktr
  • Member
  • Offline
  • Registered: 2010-05-12
  • Posts: 13

Topic: webmail brute force attack

Hello!
I'm under a bruteforce attack in the roundcube webmail, how i can auto block the IP(s), like a PAM to sshd, when a Ip have 3 wrong logongs or invalid users?

(my english isn't good)

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,082

Re: webmail brute force attack

Try fail2ban.

3 Reply by rex_ray

  • rex_ray
  • Member
  • Offline
  • Registered: 2010-09-02
  • Posts: 37

Re: webmail brute force attack

I myself use a Roundcube Webmail plugin called "rcguard" which shows a "captcha" after 5 login attempt failures ( no.of attempts can be altered). Only after entering both the "password" & "captcha" correctly, the user will be able to login. Other plugins with similar functionality are "antibruteforce" , "captcha". "Fail2ban" specified by ZhangHuangbin is also a nice option. Google "roundcube plugin repository" and you'll find them.

4 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,082

Re: webmail brute force attack

captcha is a good choice, thanks for your sharing smile