Background: multiple times now, we had the problem that client applications like Thunderbird/Enigmail/SOGo Connector "ran wild" and tried to access SOGo up to multiple hundred times per second (!), usually with wrong credentials. This results in heavily degraded performance for the rest of the users.

We'd like to have an access limit per user and second, after which SOGo will cut off further access.

This will not help against distributed attacks, but very well against application errors. Counting on a {user, ip-address} base might be reasonable to prevent DOS-attacks against a single user (sending a handful of requests with a given user name would cut that user completely off). Counting on IP-address might cut of large user bases behind a common NAT and is not acceptable.