esackbauer There are no other users and there won’t be any.
Unfortunately, these attempts aren’t a recent occurrence. Even when I was using Postfix, Dovecot, SpamAssassin, and spamass-milter locally, I consistently experienced these attempts, primarily from Chinese and Korean IPs, and they persist relentlessly.
[unknown] It might be normal, but why isn’t it showing me the banned IPs in the list? The banned list on the web UI is completely empty. Previously, before the update, it would show and ban hundreds of IPs. Now, after the update, since I can only log in with /admin, it doesn’t show anything.
Specifically, there were times when it displayed the banned IPs on the web interface in blue, but those disappeared after an update.
I don’t understand why mailcow doesn’t have a simple email notification option for banned IPs, like my local fail2ban setup does. Of course, I can go into the Docker containers and check the logs, and maybe it’s still banning them, but that’s not how I want to monitor it. I want to see when someone tries to log in and brute-force, and know that my system is banning them for a week after one attempt, as configured.
It’s set to a week because in my previous system, I had it set to a /16 range and one attempt would result in a year-long ban. Unfortunately, this made the log file very large, and it might have caused some freezing or slowdown due to nftables or something similar. I’m not entirely sure, but it became very slow. Now, I’ve set it to /32 for a week, so at least the blocks expire after a week.
