mail-balance Gratuit

Mail sessions from one address failing far more often than they succeed — a compromised client or a stuffing tool, whatever the pace

Catégorie

mail

Seuil

10/2h

Politique de ban

auth

Signalement

mail-intrusion

Parseurs

dovecot-auth-fail postfix-sasl-fail dovecot-login-ok postfix-auth-ok

Pourquoi elle est écrite ainsi

Le fichier de la règle Voir le brut

# Mail sessions that failed weighed against those that succeeded: a
# session ending in "auth failed" counts one, a successful login
# forgives three, ten net failures in two hours is an address that only
# ever fails — a stale password with no working device beside it, an
# unknown mailbox hammered (no password hash to make distinct), a
# guesser under the distinct-hash rules' radar. A customer's phone with
# one stale password beside a laptop that logs in fine nets to nothing.
# CrowdSec's dovecot-balance (fail 1, success 3, ≥ 10 in 2h). Negative
# weight: the verdict waits out the lateness allowance.
# Both doors: Dovecot's login lines (IMAP/POP3) and Postfix's SASL
# lines (SMTP) — Dovecot logs nothing for an SMTP login on a mailbox
# that does not exist, Postfix does (2026-09-22: a guesser walking
# unknown mailboxes over SMTP was read by no rule).
rule: mail-balance
description: "Mail sessions from one address failing far more often than they succeed — a compromised client or a stuffing tool, whatever the pace"
about:
  purpose: >-
    Catch what the password rules cannot see — an address that only ever fails, with no working device beside it.
  blocks: >-
    Ten net failures in two hours, where a successful login forgives three. A stale password with a working phone next to it nets to nothing.
  applies_to: >-
    Any machine running Dovecot or Postfix SASL.
  requires:
    - >-
      The mail log, declared as `log: mail` — /var/log/mail.log on Debian and Ubuntu, /var/log/maillog on RHEL and its family.
    - >-
      The mail ports declared beside that log, so a ban closes the mail and leaves the websites alone.
  beware:
    - >-
      This is the rule that catches an unknown mailbox being hammered, where there is no password hash to make distinct. It needs no Dovecot setting, which is why it is the one that works on a stock install.
category: mail
parsers:
  - parser: dovecot-auth-fail
    weight: 1
  - parser: postfix-sasl-fail
    weight: 1
  - parser: dovecot-login-ok
    weight: -3
  - parser: postfix-auth-ok
    weight: -3
threshold: 10/2h
ban: auth
report: mail-intrusion