Crowdsec and imap

[stephdl (Stéphane de Labrusse)]

@fasttech

May 13 09:11:21 node02 dovecot[1206704]: imap-login: Login: user=<user>, method=PLAIN, rip=192.168.23.45, lip=192.168.23.122, mpid=69090, TLS, session=<eegDO7VRbu/AqBct>
May 13 09:11:21 node02 dovecot[1206704]: imap(user)<69090><eegDO7VRbu/AqBct>: Disconnected: Logged out in=36 out=585 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
May 13 09:15:05 node02 dovecot[1206704]: imap-login: Login: user=<user2>, method=PLAIN, rip=12.190.205.212, lip=192.168.23.122, mpid=69101, TLS, session=<7Y9hSLVR08UMvs3U>
May 13 09:15:12 node02 dovecot[1206704]: imap(user2)<69101><7Y9hSLVR08UMvs3U>: Disconnected: Connection closed (IDLE running for 0.001 + waiting input for 5.649 secs, 2 B in + 10 B out, state=wait-input) in=287 out=1706 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
May 13 09:16:21 node02 dovecot[1206704]: imap-login: Login: user=<user>, method=PLAIN, rip=192.168.23.45, lip=192.168.23.122, mpid=69111, TLS, session=<40vlTLVRcu/AqBct>
May 13 09:16:21 node02 dovecot[1206704]: imap(user)<69111><40vlTLVRcu/AqBct>: Disconnected: Logged out in=36 out=585 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0

Hello Fastech, two completely different log types

1. The original logs (document 1) — NS8 aggregated format
   2026-05-12T16:26:05-07:00 [1:mail1:dovecot] imap-login: Disconnected: Connection closed (auth failed…)
   These are attack logs — repeated authentication failures from 34.126.176.149 across 4 hours, targeting common usernames (sales, contact, admin, hr, support…). Classic slow brute-force pattern. However they are useless for CrowdSec testing because the format is NS8’s own aggregated journal format, not what CrowdSec actually reads from journald.

2. The journald logs you captured later — real syslog format
   May 13 09:11:21 node02 dovecot[1206704]: imap-login: Login: user=…
   May 13 09:11:21 node02 dovecot[1206704]: imap(user)<69090>: Disconnected: Logged out…
   These are legitimate connection logs — successful logins followed by clean disconnections (Logged out, IDLE). No attack here at all. These are what CrowdSec actually processes, and they correctly produce no alerts.