[Full-disclosure] Secure OWA
senatorfrog at gmail.com
Wed Aug 30 19:40:41 BST 2006
On 8/30/06, Renshaw, Rick (C.) wrote:
> There's two sides to this risk. If you allow OWA logins to lock out
> accounts, and your OWA page is available from anywhere on the Internet, you
> are handing an easy DOS tool to anyone that knows the account names for
> people on your server.
I think a possibly better approach, although it doesn't seem like you
could implement it quite as simply as account lockouts, would be to
lock out, not the account, but the originating IP address, for a
Full-Disclosure is hosted and sponsored by Secunia.