I am implementing a web service and have a daemon process that notices repeated failed login attempts from any given source. If too many occur the IP address is blocked for a given time.
This is similar to the fail2ban or (now deprecated) denyhosts packages.
My concern is if the bad actor is behind a NAT gateway for a large organization (a university or Fortune 1000 for example) then the ban will affect everyone behind that gateway, not just the one station running dictionary attacks.
Is there any viable method for avoiding that side effect?
UPDATE: I changed the title as per suggestion and it occurs to me that this problem applies to nearly any kind of attack, not just the dictionary attack I outlined.