cscli scenarios install Guezli/mailcow-f2b-feedPropagates Mailcow's internal F2B bans into the local Crowdsec LAPI, so the host-side nftables-bouncer (and any other Crowdsec consumer) sees and acts on bans that Mailcow detects but Crowdsec wouldn't catch by itself.
Mailcow ships its own Fail2Ban-equivalent (netfilter-mailcow) which subscribes
to a Redis channel populated by SOGo, dovecot, postfix, the Mailcow admin UI
and rspamd. It implements iptables-level bans inside Mailcow's Docker network.
The catch: those bans live only in Mailcow's container network. They never reach Crowdsec, so:
This scenario closes the gap. It triggers on each parsed Mailcow-F2B ban line and produces a Crowdsec LAPI decision for the banned IP.
Guezli/mailcow-f2b-bans (provided in the same PR)netfilter-mailcow Docker container's stdout1source: docker2container_name:3 - mailcowdockerized-netfilter-mailcow-14labels:5 type: mailcow-f2b
behavior label is generic:bruteforce because the underlying ban can
come from any of the layers Mailcow's F2B watches (SMTP, IMAP, webmail UI,
admin UI, rspamd UI), not just one specific protocol.blackhole: 1h prevents bucket spam from repeated ban-renew lines on the
same IP within an hour -- the actual Crowdsec decision lifetime is set by
your profile, not by blackhole.1# Propagate Mailcow's internal F2B bans into the local Crowdsec LAPI,2# so the host-side nftables-bouncer (and any other Crowdsec consumers)3# act on bans that Mailcow detects but Crowdsec wouldn't on its own4# (SOGo webmail UI, rspamd admin UI, Mailcow-specific dovecot/postfix5# patterns).6#7# Requires the companion parser `Guezli/mailcow-f2b-bans`, which sets8# evt.Meta.log_type to `mailcow_f2b_ban` on parsed ban lines.910type: trigger11name: Guezli/mailcow-f2b-feed12description: "Propagate Mailcow internal F2B bans into the local Crowdsec LAPI"13filter: "evt.Meta.log_type == 'mailcow_f2b_ban'"14groupby: evt.Meta.source_ip15blackhole: 1h16labels:17 service: mailcow-f2b18 remediation: true19 confidence: 320 spoofable: 021 classification:22 - attack.T111023 behavior: "generic:bruteforce"24 label: "Mailcow F2B Cross-Layer Feed"25references:26 - https://docs.mailcow.email/27 - https://github.com/Guezli/crowdsec-mailcow-f2b-feed28