Collecting and blocking IP addresses of failed login attempts

Today we gonna explore a interesting security issue and solution for it. While most organization are using centralized logging and centralized firewalls, services running on standalone servers or VMs have been always a target to malicious actors. In today post we will dive into authentication failures and ways to protect ourselves from those. In our scenario we will be protecting a mail server, which is running postfix and dovecot locally. However the method described here is not limited to the services mentioned above and can be applied to a large number of others.

[Read More]