Slow, distributed password guessing against the mail server stays under CrowdSec's radar – idea for a "slow" scenario

[fasttech]

I’ve seen related behavior.

Seems like failtoban would've dealt with this ... DoS and log storage filler better

I clearly remember failtoban in NS7 banning an ip for failed login attempts for a period of time with the option in the NS7 ui to permaban said ip. That is literally the above scenario. Does this help explain what I’m saying? Fail2ban — NethServer 7 Final

Crowdsec and imap

NethServer Version: 8 Module: crowdsec I have been blocking subnets because of excessive imap login attempts. I am curious if anyone knows why crowdsec does not intercede with continuous auth fail for imap per ip. Is this something that is “there’“ but not enabled “out of the box”?