POP3 Brute-Force Protection

• POP3 brute-force protection overview
• How to enable and configure POP3 brute-force protection

RdpGuard protects your POP3 server from brute-force attacks. It monitors mail server logs or unencrypted POP3 traffic and blocks the attacker's IP address when failed login attempts reach the configured limit.

1. Open RdpGuard Dashboard and click POP3 under Monitored protocols.

   

2. Select Enable POP3 protection, choose a monitoring method and configure it as described below. Then click Save.

   

Monitoring method for POP3

Choose how RdpGuard detects failed POP3 login attempts:

• Logs - read supported mail server logs.
• Traffic - monitor unencrypted POP3 traffic.

Log-based monitoring

Logs is the recommended default method. It uses fewer resources than Traffic and works with SSL/TLS connections. RdpGuard can also detect usernames when they are available in the supported log records.

POP3 server

Select the mail server software installed on this computer:

• MailEnable
• Kerio Connect
• hMailServer
• MS Exchange
• Axigen Mail Server
• MDaemon Email Server
• SmarterMail

Log location

Make sure server logging is enabled, then specify where RdpGuard should read the logs:

• Kerio Connect: select the security.log file.
• Axigen: select the security.txt file. Enable security logging with enableSecurityLog = yes in axigen.cfg.
• MailEnable: select its POP3 log folder, usually C:\Program Files (x86)\Mail Enable\Logging\POP.
• hMailServer, MDaemon and SmarterMail: select the server's log folder.
• MS Exchange: select the POP3 protocol log folder, usually C:\Program Files\Microsoft\Exchange Server\V15\Logging\Pop3. A log folder is required; Windows Application Event Log monitoring is not supported for POP3.

Exchange POP3 protocol logging is disabled by default. To enable it, run this command in Exchange Management Shell, replacing YOUR-SERVER with your server name:

Set-PopSettings -Server "YOUR-SERVER" -ProtocolLogEnabled $true

Restart the Exchange POP3 services to apply the logging change; see Microsoft's protocol logging instructions.

Click Save in POP3 Settings to apply your RdpGuard configuration.

Traffic-based monitoring

Traffic detects failed logins by recognizing known authentication-error responses in unencrypted POP3 traffic. It uses more resources than Logs and does not detect usernames.

It cannot inspect SSL/TLS traffic, including connections upgraded to TLS after connecting. Use Logs for encrypted connections.

Select Traffic, then choose a capture method:

• WinPcap/Npcap (recommended) - install WinPcap or Npcap, then click Configure... to select the network adapter to monitor.
• Raw Sockets - may affect network performance and may not work with some firewalls or Windows editions.

POP3 ports

Leave this field empty to monitor port 110, or enter the ports used by your POP3 server. Separate multiple ports with commas, for example 110, 1110. Adding an encrypted port such as 995 does not enable SSL/TLS traffic monitoring.

Click Save to apply the settings. To check for monitoring errors, open View, Show event log in RdpGuard Dashboard.