Dovecot

Report IMAP and POP3 password guessing.

Bots guess IMAP and POP3 passwords as eagerly as SMTP ones. Dovecot logs each failed login with the remote address after rip=.

Report IMAP and POP3 brute force

grep "auth failed" /var/log/mail.log | grep -oE 'rip=[0-9a-fA-F.:]+' | cut -d= -f2 | sort | uniq -c | awk '$1>=5{print $2}' | xargs -r -I{} curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" -d ip={} -d categories=mail-server-attack,brute-force -d comment="dovecot: IMAP/POP3 brute force"

Depending on your distribution, Dovecot may log to /var/log/dovecot.log or only to the journal (journalctl -u dovecot).

With fail2ban

Enable the dovecot jail and add the isipsafe action with categories="mail-server-attack,brute-force".

Need a hand?

If something here does not work with your version of Dovecot, or you have improved it, tell us. We update these pages with what people send.

Dovecot and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.