[Dovecot][Netfilter] Report failed logins from mailcowauth.php, anchor default rules

data/conf/dovecot/auth/mailcowauth.php

@@ -68,6 +68,8 @@ require_once 'functions.acl.inc.php';
 
 
 $isSOGoRequest = $post['real_rip'] == getenv('IPV4_NETWORK') . '.248';
+// real_rip is the address that connected to Dovecot (for proxied connections the proxy), client_ip the client
+$client_ip = filter_var($post['client_ip'] ?? '', FILTER_VALIDATE_IP) ? $post['client_ip'] : $post['real_rip'];
 $result = false;
 if ($isSOGoRequest) {
   // This is a SOGo Auth request. First check for SSO password.
@@ -121,7 +123,14 @@ if ($result) {
   http_response_code(200); // OK
   $return['success'] = true;
 } else {
-  error_log("MAILCOWAUTH: Login failed for user " . $post['username'] . " with service " . $post['service'] . " from IP " . $post['real_rip']);
+  // Same line for the log and netfilter, which counts it for IMAP, POP3, Sieve and SMTP (Postfix asks Dovecot);
+  // SOGo logins have their own rule
+  $failed = "MAILCOWAUTH: Login failed for user " . $post['username'] . " with service " .
+    preg_replace('/[^a-z0-9]/', '', strtolower((string)$service)) . " from IP " . $client_ip;
+  error_log($failed);
+  if (!$isSOGoRequest) {
+    $redis->publish("F2B_CHANNEL", $failed);
+  }
   http_response_code(401); // Unauthorized
 }
 

data/conf/dovecot/auth/passwd-verify.lua

@@ -1,8 +1,4 @@
 function auth_password_verify(request, password)
-  if request.domain == nil then
-    return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, "No such user"
-  end
-
   local json = require "cjson"
   local ltn12 = require "ltn12"
   local https = require "ssl.https"
@@ -11,7 +7,10 @@ function auth_password_verify(request, password)
   local req = {
     username = request.user,
     password = password,
+    -- address that connected to Dovecot, for proxied connections the proxy
     real_rip = request.real_rip,
+    -- address of the client, also for proxied connections
+    client_ip = request.rip,
     service = request.service
   }
   local req_json = json.encode(req)