Mailcow comprehensive protection

One-command install of a layered Crowdsec stack for Mailcow running on the host (not inside the Mailcow Docker network). Covers SMTP-AUTH, IMAP/POP-AUTH, and propagation of Mailcow-internal F2B bans into the local LAPI so the nftables-bouncer enforces them on Layer 3.

Installation

1sudo cscli collections install Guezli/mailcow
2sudo systemctl reload crowdsec

You still need acquisition stanzas that read the relevant container logs (see below).

What's inside

Official Hub coverage (pulled in via collections:)

• crowdsecurity/postfix — postfix-logs parser + postfix-spam, postfix-helo-rejected, postfix-relay-denied, postfix-non-smtp-command
• crowdsecurity/dovecot — dovecot-logs parser + dovecot-spam

Slow / distributed / honeypot patterns (mine)

• Guezli/postfix-sasl-bf — slow / distributed SASL bruteforce (capacity 2, leakspeed 2h). Companion to crowdsecurity/postfix-spam's fast-pattern detection.
• Guezli/postfix-honeypot-users — instant-ban for SASL attempts against role/admin usernames (postmaster@, admin@, info@, ...).
• Guezli/mailcow-f2b-bans (parser) + Guezli/mailcow-f2b-feed (scenario) — pull Mailcow's internal netfilter-mailcow bans into the Crowdsec LAPI so they propagate to the host-side bouncer.

IMAP / POP slow-pattern coverage (third-party)

• melite/dovecot-slow-bf — slow IMAP/POP bruteforce
• melite/dovecot-time-based-bf — time-distributed IMAP/POP bruteforce
• hitech95/mail-generic-bf — unified mail-auth bruteforce (SMTP+IMAP+POP)

Acquisition examples

Add the following to /etc/crowdsec/acquis.d/mailcow.yaml:

1# postfix container
2source: docker
3container_name:
4  - mailcowdockerized-postfix-mailcow-1
5labels:
6  type: syslog
7---
8# dovecot container
9source: docker
10container_name:
11  - mailcowdockerized-dovecot-mailcow-1
12labels:
13  type: syslog
14---
15# netfilter-mailcow container (Mailcow-internal F2B)
16source: docker
17container_name:
18  - mailcowdockerized-netfilter-mailcow-1
19labels:
20  type: mailcow-f2b

Notes

• Crowdsec runs on the Mailcow host, not inside a Mailcow container. The host-side nftables-bouncer enforces bans on Layer 3 before they reach Mailcow's Docker network.
• mailcow-f2b-feed is what makes Crowdsec see SOGo-webmail, rspamd-admin and dovecot-cluster bruteforces that Crowdsec out-of-the-box doesn't parse.
• The honeypot user list in Guezli/postfix-honeypot-users is customizable for your environment — fork the scenario if you legitimately use any of the listed addresses for SMTP-AUTH.
• Project home with installer scripts and tuning notes: https://github.com/Guezli/postfix-sasl-bf https://github.com/Guezli/postfix-honeypot-users https://github.com/Guezli/crowdsec-mailcow-f2b-feed