Hi everyone, I’m currently setting up Mailcow and want to ensure my setup is as secure as possible. I’ve come across a few points where I’d appreciate your insights and experiences: 1. Securing the Rspamd UI Is there a way to restrict access to the Rspamd UI to specific IP addresses? If so, how can this be configured? Are there other recommended methods to protect the Rspamd UI from unauthorized access, such as adding extra authentication or using a reverse proxy? 2. Using a Reverse Proxy for Security Does using a reverse proxy (e.g., NGINX or Traefik) provide additional security benefits for Mailcow? If yes, what specific security measures can I implement through the reverse proxy (e.g., IP whitelisting, rate limiting, additional authentication)? Or is Mailcow’s built-in security sufficient, and a reverse proxy is only necessary for other purposes like performance optimization? 3. Securing or Disabling the Swagger API The Swagger UI for the API is enabled by default. Should I disable it to reduce the attack surface? If I keep it enabled, are there best practices for securing the API interface (e.g., restricting access to internal IPs or adding extra authentication)? 4. Are these measures necessary? Are the steps above truly necessary for improving Mailcow’s security, or are they overkill? Which of these measures would you consider essential, and where can I avoid unnecessary effort? 5. Additional Security Tips Do you have any other recommendations or proven methods to make a Mailcow setup more secure? I’d like to ensure my server isn’t an easy target for attacks and would greatly appreciate any advice or ideas on how to enhance security. Thanks in advance for your support! 😊

Securing Mailcow: Rspamd UI, Reverse Proxy, Swagger API, and Additional Tips

Gumminess

Hi everyone,

I’m currently setting up Mailcow and want to ensure my setup is as secure as possible. I’ve come across a few points where I’d appreciate your insights and experiences:

Securing the Rspamd UI
Is there a way to restrict access to the Rspamd UI to specific IP addresses? If so, how can this be configured?
Are there other recommended methods to protect the Rspamd UI from unauthorized access, such as adding extra authentication or using a reverse proxy?
Using a Reverse Proxy for Security
Does using a reverse proxy (e.g., NGINX or Traefik) provide additional security benefits for Mailcow?
If yes, what specific security measures can I implement through the reverse proxy (e.g., IP whitelisting, rate limiting, additional authentication)?
Or is Mailcow’s built-in security sufficient, and a reverse proxy is only necessary for other purposes like performance optimization?
Securing or Disabling the Swagger API
The Swagger UI for the API is enabled by default. Should I disable it to reduce the attack surface?
If I keep it enabled, are there best practices for securing the API interface (e.g., restricting access to internal IPs or adding extra authentication)?
Are these measures necessary?
Are the steps above truly necessary for improving Mailcow’s security, or are they overkill?
Which of these measures would you consider essential, and where can I avoid unnecessary effort?
Additional Security Tips
Do you have any other recommendations or proven methods to make a Mailcow setup more secure?
I’d like to ensure my server isn’t an easy target for attacks and would greatly appreciate any advice or ideas on how to enhance security.

Thanks in advance for your support! 😊

esackbauer

Noone can answer those questions for you, it depends on your individual risk profile.
From my viewpoint a Web Application Firewall in front of mailcow is something you want to have.
But it makes no sense if you do not know how to set up hardening rules and especially alerting.
I use Sophos Firewall. With WAF you can limit or exclude URLs to be reachable. Its free for personal use.

But in fact, mailcow is pretty secure out of the box, with fail2ban already integrated. The most attacked surface are weak passwords and no 2FA and not up-to-date software. If you have this covered, its secure enough I would say.