Fail2Ban

To prevent brute-force attacks, Mailcow blocks IP addresses from which failed login attempts have been detected. The block occurs at firewall level, which means the services are no longer reachable.

The following services are checked for failed logins:

  • IMAP

  • POP3

  • SMTP

  • CalDAV

  • CardDAV

  • Mailcow Web UI

  • SOGo and Roundcube Web UI

Configuration

  1. Open mail.example.com/admin and log in with your admin credentials

  2. Navigate to “System” (top right corner) -> “Configuration” -> “Options” -> “Fail2Ban”

There you can configure the following options:

  • Ban time

  • Max. ban time

  • Max. attempts

  • Retry windows for max. attempts

  • IPv4 subnet size to apply ban on

  • IPv6 subnet size to apply ban on

  • Allowlist for IP addresses that should never be banned

  • Denylist for IP addresses that should always be banned

Unbanning

  1. Open the configuration page as described above

  2. Scroll down to the bottom of the page

  3. Search for the IP address you want to unban and click on “unban”

  4. Wait up to 60 seconds for the changes to take effect

If the IP address is banned again, it is likely that there is an active brute-force attack from that IP address or the IP address is part of a network that is being used for brute-force attacks. Sometimes it is also possible that a client (e.g. Outlook, Calendar, etc.) is misconfigured and keeps trying to log in with wrong credentials. In this case, you should check the client configuration and correct it. See also the Mailcow logs for more information about failed login attempts.