IMAP Brute-Force Protection

• IMAP brute-force protection overview
• How to enable and configure IMAP brute-force protection

RdpGuard protects your IMAP server from brute-force attacks. It monitors mail server logs or unencrypted IMAP traffic and blocks the attacker's IP address when failed login attempts reach the configured limit.

1. Open RdpGuard Dashboard and click IMAP under Monitored protocols.

   

2. Select Enable IMAP protection, choose a monitoring method and configure it as described below. Then click Save.

   

Monitoring method for IMAP

Choose how RdpGuard detects failed IMAP login attempts:

• Logs - read supported mail server logs.
• Traffic - monitor unencrypted IMAP traffic.

Log-based monitoring

Logs is the recommended default method. It uses fewer resources than Traffic and works with SSL/TLS connections. RdpGuard can also detect usernames when they are available in the supported log records.

IMAP server

Select the mail server software installed on this computer:

• MailEnable
• Kerio Connect
• hMailServer
• MS Exchange
• Axigen Mail Server
• MDaemon Email Server
• SmarterMail

Log location

Make sure server logging is enabled, then specify where RdpGuard should read the logs:

• Kerio Connect: select the security.log file.
• Axigen: select the security.txt file. Enable security logging with enableSecurityLog = yes in axigen.cfg.
• MailEnable, hMailServer, MDaemon and SmarterMail: select the server's log folder.
• MS Exchange: select the IMAP protocol log folder, usually C:\Program Files\Microsoft\Exchange Server\V15\Logging\Imap4. A log folder is required; Windows Application Event Log monitoring is not supported for IMAP.

Exchange IMAP protocol logging is disabled by default. To enable it, run this command in Exchange Management Shell, replacing YOUR-SERVER with your server name:

Set-ImapSettings -Server "YOUR-SERVER" -ProtocolLogEnabled $true

Restart the Exchange IMAP4 services to apply the logging change; see Microsoft's protocol logging instructions.

Click Save in IMAP Settings to apply your RdpGuard configuration.

Traffic-based monitoring

Traffic detects failed logins by recognizing known authentication-error responses in unencrypted IMAP traffic. It uses more resources than Logs and does not detect usernames.

It cannot inspect SSL/TLS traffic, including connections upgraded with STARTTLS. Use Logs for encrypted connections.

Select Traffic, then choose a capture method:

• WinPcap/Npcap (recommended) - install WinPcap or Npcap, then click Configure... to select the network adapter to monitor.
• Raw Sockets - may affect network performance and may not work with some firewalls or Windows editions.

IMAP ports

Leave this field empty to monitor port 143, or enter the ports used by your IMAP server. Separate multiple ports with commas, for example 143, 1143. Adding an encrypted port such as 993 does not enable SSL/TLS traffic monitoring.

Click Save to apply the settings. To check for monitoring errors, open View, Show event log in RdpGuard Dashboard.