Fail2ban does not block failed login attempts to Plesk Premium Email webmail.
Fail2ban does not block failed login attempts to Plesk Premium Email webmail.
Plain Roundcube is blocked by jail plesk-roundcube after failing all attempts to log in.
If the webmail is switched to Plesk Premium Email, the jail plesk-roundcube does not block failed attempts.
As a workaround create the following filter:
cat /etc/fail2ban/filter.d/kolab-webmail.conf
[Definition]
failregex = ^[\d{4}-[A-Za-z]{3}-\d{2} \d{2}:\d{2}:\d{2} +\d{4}]: <[^>]+> Failed login for .* from <HOST> in session .*
ignoreregex =
Also add the jail into /etc/fail2ban/jail.d/plesk.conf:
[kolab-webmail]
enabled = true
filter = kolab-webmail
port = http,https
logpath = /var/log/roundcubemail/userlogins.log
maxretry = 1
findtime = 600
bantime = 3600
backend = auto
