Pegasus Mail & Mercury

How can I disable short-term blacklisting in mercury/32 4.62 POP3 (and IMAP4) server for some ip addresses (perhaps 127.0.0.1 which is the endpoint of a SSL-stunnel).

Many thanks,

Thomas

Once you are on the STB, either wait 30 mins () or restart Mercury.

To NOT get on the list, add the IP or IP range to the 'Connection Control' list (in mercS config) and tick 'Exempt from transaction filtering'.

Sorry, but that doesn't help. The short-term blacklisting in the POP3 and IMAP4 server can not be controlled by the SMTP server configuration.

 

All the Mercury server modules have a 'Connection control' tab in their configuration.  Have you tried entering 'allow' IP entries in those?

 

Yes, but that doesn't disable the short-term blacklisting feature.

Sorry, must read more carefully

There really should be an off switch on this, and you are right there isn't.

What is triggering it, maybe that could be fixed?

 

passau:

Yes, but that doesn't disable the short-term blacklisting feature.

How is the blacklisting affecting your IMAP connections?  I'm using both stunnel and direct connections and don't see the issue you are having.

an "excessive password failure" is triggering the short-term blacklisting.

But that could not be fixed in all circumstances..

all our users must use the SSL-connection over stunnel (the firewall blocks unsecure direct connections over the internet) and therefore the short-term blacklist of the stunnel (127.0.0.1) forbidds any new connections to the services POP3 and IMAP.

maybe time to revisit your firewall policy?

what is the problem with an open mail port?

with SSL without the tunnel. 

passau:

an "excessive password failure" is triggering the short-term blacklisting.

I've managed to reproduce this with the POP server (but not with IMAP and it does not appear to affect my IMAP connections).

I don't recall reading about this before, and unlike the SMTP compliance backlisting, this is not a configuration option. :(

As DLN suggests, can you not use the built-in SSL/TLS connections, or are you like me, running an older OS where they are incompatiple?

passau:

an "excessive password failure" is triggering the short-term blacklisting.

I'll see what I can do about this - it's probably as easy as adding the same sort of connection control exemption as exists in MercuryS. If it turns out to be as easy as I think it will be, then I should be able to get a patch out fairly quickly.

Cheers!

-- David --

that's perfect. Many thanks David.

Thomas