I already run fail2ban on my home server, and it does its job well: it watches the mail and SSH logs, and it bans brute-forcers within a second or two. But fail2ban has two structural limits. It’s reactive — an attacker has to hit my server, and fail long enough to trip a jail, before anything happens. And it’s local — every server learns about every attacker from scratch, on its own.
[Read More]Hardening a Self-Hosted Mail Server: fail2ban, Postfix, and Dovecot
My home server runs a full mail stack — Postfix, Dovecot, Rspamd, ClamAV — on MicroShift. It’s exposed directly to the internet on ports 25 and 587. That means it gets attacked. Here’s how I protect it, what the attacks look like in the logs, and how I recently tightened the configuration after spotting a gap.
The Threat Landscape
Two distinct attack types show up regularly in the logs:
1. SASL Brute-Force — Attackers try username/password combinations via SMTP AUTH or IMAP. The pattern: multiple IPs, each trying a different username, typically in parallel waves.
[Read More]