- Dovecot-test - dovecot.org

Re: Blocking with RBLs
by Aki Tuomi 10 Jan '26

10 Jan '26

On January 10, 2026 9:08:58 AM GMT+02:00, John Fawcett via dovecot <dovecot(a)dovecot.org> wrote: > >On 10/01/2026 03:04, Joseph Tam via dovecot wrote: >> On Fri, 9 Jan 2026, John Fawcett wrote: >> >>> I find it useful (both on Postfix and Dovecot) to apply XBL to block connection to authenticated services. >> >> I grep'd through last week's logs for probable brute forcers, and check the >> IPs against 3 RBLs. (Many IPs tried only once.) >> >> Aggregate statistics: >> >> 87 - - - (No hits) >> 46 + - - >> 32 + + - >> 9 + - + >> 6 + + + >> 5 - + - >> 4 - - + >> >> 102/189 (54%) were listed by at least one of the RBLs, with the following stats >> >> RBL hits rate rate (>0 hits) >> (col#1) bl.blocklist.de 93 49% 91% >> (col#2) auth.spamrats.com 52 28% 51% >> (col#3) xbl.spamhaus.org 19 10% 19% >> >> You should try one of the other 2 RBLs: they specificaly list brute >> forcers. I use them as pre-emptive block-on-sight for SMTP auth, and >> I don't recall ever getting a false positive. >> >> Joseph Tam <jtam.home(a)gmail.com> > >Hi Joseph > >thanks for the tip. I do use auth.spamrats.com on smtp auth, not so far on imap/managesieve. I do know of blocklist.de but I can't remember now if I evaluated to use it in this context. I will look into those. > >Out of curiosity are those data from smtp auth or from Dovecot brute force auth attempts? I assume Dovecot but wanted to make sure I understood correctly. Do you do any kind of blocking on Dovecot that could influence the numbers? > >It's a while since I checked blocking performance, but what I seem to remember is that I got a lot more attempts before I started blocking, so what I see now with blocking applied is not necessarily representative of what I would see if I didn't block. My assumption is that behind multiple ips there can be the same actor switching ips to fly under the radar of fail2ban. When applying outright blocking at connection time seems that the actors can move on elsewhere and consequently you end up avoiding more than you actually see as rejects. That's kind of anecdotal, I don't think I have hard evidence of it. > >John > > > >_______________________________________________ >dovecot mailing list -- dovecot(a)dovecot.org >To unsubscribe send an email to dovecot-leave(a)dovecot.org This is a reply with paragraph of text to see how it would look like. Aki

1 0

Test
by Aki Tuomi 10 Jan '26

10 Jan '26

test

1 0

testing html
by Aki Tuomi 07 Mar '25

07 Mar '25

Hi! This is again html test https://www.dovecot.org is a link dark red text Aki

1 0

testing
by Aki Tuomi 07 Mar '25

07 Mar '25

1 0

Re: Doveadm Backup Error
by Timo Sirainen 18 Feb '25

18 Feb '25

Häläpäti häläpäti > On 18. Feb 2025, at 10.41, Timo Sirainen <timo(a)sirainen.com> wrote: > > On 17. Feb 2025, at 16.26, Asai via dovecot <dovecot(a)dovecot.org> wrote: >> >> sieve_script personal { >> active_path = /vmail/%{user | domain }/%{user | username }/home/.dovecot.sieve >> driver = file >> path = /vmail/%{user | domain }/%{user | username }/home/sieve >> } > > Looks like %variables aren't really working right with Sieve / doveadm combination. It gives an error: > > Error: sieve: sieve_file_storage settings: Failed to parse configuration: Failed to expand sieve_script_path setting variables: Unknown variable 'user' > > So for now the only way is to avoid %variables there - that simplifies the config anyway: > > sieve_script personal { > active_path = ~/.dovecot.sieve > path = ~/sieve > } Häläpäti häläpäti On 18. Feb 2025, at 10.41, Timo Sirainen <timo(a)sirainen.com> wrote: On 17. Feb 2025, at 16.26, Asai via dovecot <dovecot(a)dovecot.org> wrote: sieve_script personal { active_path = /vmail/%{user | domain }/%{user | username }/ home/.dovecot.sieve driver = file path = /vmail/%{user | domain }/%{user | username }/home/sieve } Looks like %variables aren't really working right with Sieve / doveadm combination. It gives an error: Error: sieve: sieve_file_storage settings: Failed to parse configuration: Failed to expand sieve_script_path setting variables: Unknown variable 'user' So for now the only way is to avoid %variables there - that simplifies the config anyway: sieve_script personal { active_path = ~/.dovecot.sieve path = ~/sieve }

1 0

Re: Doveadm Backup Error
by Timo Sirainen 18 Feb '25

18 Feb '25

Looks like %variables aren't really working right with Sieve / doveadm combination. It gives an error: Error: sieve: sieve_file_storage settings: Failed to parse configuration: Failed to expand sieve_script_path setting variables: Unknown variable 'user' So for now the only way is to avoid %variables there - that simplifies the config anyway: sieve_script personal { active_path = ~/.dovecot.sieve path = ~/sieve } > On 17. Feb 2025, at 20.34, Asai via dovecot <dovecot(a)dovecot.org> wrote: > > Thank you, Timo, that fixed the problem. > Asai > On 2/17/2025 9:03 AM, Timo Sirainen wrote: > On 17. Feb 2025, at 16.26, Asai via dovecot <dovecot(a)dovecot.org> wrote: > > sieve_script personal { > active_path = /vmail/%{user | domain }/%{user | username }/ > home/.dovecot.sieve > driver = file > path = /vmail/%{user | domain }/%{user | username }/home/sieve > } > > Looks like %variables aren't really working right with Sieve / doveadm > combination. It gives an error: > > Error: sieve: sieve_file_storage settings: Failed to parse configuration: > Failed to expand sieve_script_path setting variables: Unknown variable 'user' > > So for now the only way is to avoid %variables there - that simplifies the > config anyway: > > sieve_script personal { > active_path = ~/.dovecot.sieve > path = ~/sieve > } > > _______________________________________________ > dovecot mailing list -- dovecot(a)dovecot.org > To unsubscribe send an email to dovecot-leave(a)dovecot.org

1 0

Test
by Aki Tuomi 17 Feb '25

17 Feb '25

test

1 0

test
by Aki Tuomi 17 Feb '25

17 Feb '25

test

1 0

test
by Aki Tuomi 13 Apr '24

13 Apr '24

test

1 0

(no subject)
by aki.tuomi 07 Aug '23

07 Aug '23

TestSent from my Galaxy

1 0