We disabled the webmail block on email address and only use the IP-based one.

Same here: We disabled the webmail block on email address and only use the IP-based one. 

We have a fix in place for these aggressive IDS blocks. There were cases where a connection would count against IDS even though it shouldn't which would cause erroneous blocks. Our next minor will contain this fix, the minor you have right now @echoDreamz on your system should already contain this fix.

Matt,

Yep, we turned the IP-based IDS block for webmail back on after that update. We left the email-based webmail block disabled though.

Hi,

Isn't the email based IDS blocking a problem itself ?

I mean with this turned on, anyone willing to lock your account to put you in trouble can do it from anywhere just by trying several wrong passwords for this particular mail account ? So you get more trouble than protection.

If yes, then it sounds like a pretty bad idea to have this turned on anytime.

IMHO There should be two settings:

- IDS block by IP (will lock any further attempts from the IP)

OR

- IDS block by IP AND e-mail address  (will lock any further attempts from the IP for this particular mail address, so you don't lock out all other users of your office sharing the same IP, if one person of your office keep entering a wrong password for his account)

EDIT: a possible 3rd option that may be useful against distributed IP attempts on a particular account

- IDS block by e-mail address, only if recent attempts were made from X different IP addresses like from a distributed botnet.

Just some ideas, but locks only based only e-mail address seems a non-sense.

EDIT2: I had not entirely read the original poster post and he has the same suggestions. My apologies for the dupe.

Sébastien

The IDS rules for Brute Force by Email and Brute Force by IP can work together. It's just a matter of configuring them to work together.

Option 1: Change values
A simple solution is to simply change the default values for By IP and By Email. One way would be to decrease the number of attempts By IP to be LOWER than the By Email number. This will block the IP before the email address hits its own rule limit. You could also decrease the By IP limit and increase the By Email limit to ensure that, if you're seeing a lot of brute force attempts from multiple IPs on the same account, the account still doesn't get locked out.

Option 2: Disable By Email
Keep the By IP rules in place and disable the By Email rules. This way, IPs will continue to be blocked when there are brute force attempts, but the email account itself is never blocked. This is a good solution for cases where a particular address (or multiple addresses) are being brute forced by multiple IPs.

As an aside, we're looking at the defaults we put for each. A future build will have the By IP number smaller than the By Email number by default. That way, if both are turned on there will be some difference between the two to try and eliminate confusing and issues.