mail-auth-slow Free

Mail password guessing paced slowly, to stay under the fast rule — the same credential attack spread over hours

Category

mail

Threshold

6/6h

Ban policy

auth

Report

mail-intrusion

Parsers

dovecot-password-mismatch

Why it is written this way

The rule file View raw

# Mail password guessing paced to duck the fast rule: six DIFFERENT
# passwords refused for one address inside six hours. Distinct hashes
# again, so a stale password repeated all afternoon is one, not six
# (CrowdSec's postfix-sasl-slow-bf: capacity 5, leakspeed 90m, on raw
# failures — this is its fairer form).
rule: mail-auth-slow
description: "Mail password guessing paced slowly, to stay under the fast rule — the same credential attack spread over hours"
about:
  purpose: >-
    Catch the password guesser who paces themselves to stay under the fast rule.
  blocks: >-
    Six DIFFERENT passwords refused for one address inside six hours.
  applies_to: >-
    Any machine running Dovecot, alone or behind Postfix.
  requires:
    - >-
      The mail log, declared as `log: mail` — /var/log/mail.log on Debian and Ubuntu, /var/log/maillog on RHEL and its family.
    - >-
      The mail ports declared beside that log, so a ban closes the mail and leaves the websites alone.
    - >-
      Dovecot with `auth_verbose_passwords = sha1:6` in conf.d/10-logging.conf — off by default everywhere, and without it this rule reads zero hits, silently.
  beware:
    - >-
      Same as the fast rule: a shared address collects distinct failures honestly. Six in six hours is generous enough that it rarely happens.
category: mail
parsers: dovecot-password-mismatch
threshold: 6/6h
distinct: password_hash
ban: auth
report: mail-intrusion