Limit login attempts

[bls24]

My results from logwatch yesterday are showing somebody trying to login to an email address 113 times.

Can I limit this, say, to 9 times.. and then you get a temporary ip ban?

As well, can port 25 / 26 be disabled in the firewall without affecting mail delivery or sending? I presently connect on 995 with SSL checked.

[caeos]

have you installed the great "csf" stuff from http://www.configserver.com/cp/csf.html

that normally kickes people who attempt email log ins by 10 attempts.

Login Failure Daemon (lfd)

To complement the ConfigServer Firewall (csf), we have developed a Login Failure Daemon (lfd) process that runs all the time and periodically (every X seconds) scans the latest log file entries for login attempts against your server that continually fail within a short period of time. Such attempts are often called "Brute-force attacks" and the daemon process responds very quickly to such patterns and blocks offending IP's quickly. Other similar products run every x minutes via cron and as such often miss break-in attempts until after they've finished, our daemon eliminates such long waits and makes it much more effective at performing its task.

Login tracking is an extension of lfd, it keeps track of POP3 and IMAP logins and limits them to X connections per hour per account per IP address.