captcha support for webmail interface?

[tiger2000]

Dear all,

is it possible to have captcha support when users login via Webmail interface?

thanks.

[phoenix]

Originally Posted by tiger2000

is it possible to have captcha support when users login via Webmail interface?

Not unless you implement it or file an RFE in Bugzilla Main Page - Zimbra. Why do you think you need it? The implementation of good password policies should obviate the need for using captcha.

[ericjan]

The account locking mechanism will cause DoS when the hacker is guessing the password. I think CAPTCHA is a better solution.

Regards,
Eric

[dave_kempe]

CAPTCHA would impose a very annoying restriction on normal users.
You would be able to build something yourself I would imagine with a php app and authenticated reverse proxy anyway if you like.

[tiger2000]

could you please elaborate some details on how to build that with a php program? any other reference/document i can check?

thanks in advance.

[Dirk]

There are multiple ways to defeat most captcha systems, and they offer a different type of protection to the auto password lock system.

If someone is tryingto brute force one of your accounts, then having it lock out lets you know that something is amiss, the main admin shouldnt just go to the admin console and unlock the account, they should work out WHY the account was locked. Was it the user themselves keying in the password wrong, or was it a hacking attempt. The information gathered from that check is powerful.

If someone is trying to brute force an account, and in addition to the username and password they need a captcha, then it's not likely to stop them, they could brute force the captcha or send it's details out to services that deal with them.

If you do go ahead and impliment such a system, you'd need to be pretty secure in two things;
1, that your code is good enough to always work, every time, no exceptions. You dont want a user to be keying everything in correcty and still be unable to connect,
2, that the captcha system you use is unbreakable, you dont want to go to all this effort for a system thats trivial to defeat.

I cant offer any help with the actual coding, but I'd imagine you could simply hijack the login process to show your own login system which would, once authenticate, call Zimbra's pre-authentication mechanisms to then automatically log the user in, there's lots of detail on this in the wiki's.