On Feb 10, 2009, at 9:46 AM, jakjr wrote:
Hello,
Is there a way to block a specific ip address when this ip attempt to
bind many times if failure result ??
This could be useful to prevent a brute-force attack.
I know that ppolicy can lockout the user after some failed attempts.
But I would like to block new connections from the IP, after this IP
try to make a number of fail binds.
I would think this much better handled by an system external to
slapd(8) that would monitor slapd(8) logs and then adjust firewall
rules on the server (or upstream of the server) accordingly.
Basically, an intrusion detection system.