Issue Fast bans from Fail2Ban

[julianchntl]

Server operating system version

Ubuntu 22.04.2 LTS

Plesk version and microupdate number

Plesk Obsidian v18.0.53_build1800230619.12 os_Ubuntu 22.04

I have had a thread on the subject of Fail2Ban before. Unfortunately, I continue to have problems with it. I use Spark on the iPhone to check my mail. Lately, I get banned again very quickly by Fail2Ban when I open Spark. The jail in question is this: plesk-dovecot.
Do you guys have a solution for this or custom rules?

 

[Peter Debik]

The Dovecot jails reacts on false authentication. Please look into /var/log/maillog and check what exactly the requestor (the phone) tries to do when it attempts to login to the mailbox. For example: Does it first try an authentication algorithm that is not supported on the Dovecot installation, so that it creates a string like "auth failed" (or similar) in the maillog?

 

[julianchntl]

The Dovecot jails reacts on false authentication. Please look into /var/log/maillog and check what exactly the requestor (the phone) tries to do when it attempts to login to the mailbox. For example: Does it first try an authentication algorithm that is not supported on the Dovecot installation, so that it creates a string like "auth failed" (or similar) in the maillog?

No error, just this example line: Jul 11 13:49:28 plesk dovecot: imap-login: Login: user=<***@***.de>, method=PLAIN, rip=***, lip=***, mpid=***, TLS, session=<***>.
I have six mail accounts in Spark. Could this be what is causing it? I'm reluctant to disable the jail because I'm strangely getting a lot of extraneous login attempts.

 

[Peter Debik]

Please check again. It is not possible that the jail bans the IP for correct logins. There must be authentication issues.

 

[Kaspar]

I've seen a similar issue with the mail app on iPhones on one of my servers, but sadly I've never found the root cause. If you are absolutely positive there are no failed login attempts logged I would suggest contact Plesk Support so they can investigate the issue on your server directly.

 

[Peter Debik]

I've seen a similar issue with the mail app on iPhones on one of my servers, but sadly I've never found the root cause.

It's probably something similar to Issue - Android Mail APP - IMAP digest-md5 always fails once, but with iPhones.