Отключаем небезопасные порты Dovecot:

nano /etc/dovecot/dovecot.conf

service imap-login {
  inet_listener imap {
    port = 0
  }
}service pop3-login {
  inet_listener pop3 {
    port = 0
  }
}

Оставляем только:IMAPS (993) POP3S (995)

---

systemctl restart dovecot

---

Только TLS для отправки почты

В Postfix:

nano /etc/postfix/main.cf

Проверяем:

smtpd_tls_auth_only = yes

---

Ограничиваем brute-force Dovecot (IMAP)

mail_max_userip_connections = 5

---

Postfix (SMTP)

smtpd_client_connection_count_limit = 10
smtpd_client_connection_rate_limit = 20
smtpd_hard_error_limit = 20
smtpd_soft_error_limit = 10

---

Fail2Ban — базовая защита

nano /etc/fail2ban/jail.d/dovecot.local

[dovecot]
enabled = true
filter = dovecot.iredmail
logpath = /var/log/dovecot/*.log
maxretry = 5
findtime = 600
bantime = 3600

---

nano /etc/fail2ban/jail.d/postfix.local

[postfix]
enabled = true
filter = postfix.iredmail
logpath = /var/log/mail.log
maxretry = 5
findtime = 600
bantime = 3600

---

Recidive — “вечный бан” для повторных атак

nano /etc/fail2ban/jail.d/recidive.local

[recidive]
enabled = true
logpath = /var/log/fail2ban.log
bantime = 604800
findtime = 86400
maxretry = 5

---

Webmail (Roundcube)

$config['default_host'] = 'ssl://127.0.0.1:993';
$config['smtp_host'] = 'tls://127.0.0.1:587';

---

Мониторинг атак Проверка банов:

fail2ban-client status dovecot

---

Топ атакующих IP:

grep Ban /var/log/fail2ban.log | awk '{print $NF}' | sort | uniq -c | sort -nr | head

#iredmailserver #mailserver #почтовыйсервер #защитапочтовогосервера