[Dovecot][Netfilter] Report failed logins from mailcowauth.php, anchor default rules

data/conf/dovecot/dovecot.conf

@@ -51,13 +51,6 @@ recipient_delimiter = +
 auth_master_user_separator = *
 mail_shared_explicit_inbox = yes
 mail_prefetch_count = 30
-passdb {
-  driver = lua
-  args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes cache_key=%s:%u:%w
-  result_success = return-ok
-  result_failure = continue
-  result_internalfail = continue
-}
 # try a master passwd
 passdb {
   driver = passwd-file
@@ -67,8 +60,9 @@ passdb {
 }
 # check for regular password - if empty (e.g. force-passwd-reset), previous pass=yes passdbs also fail
 # a return of the following passdb is mandatory
+# each check asks mailcowauth.php, which reports a failed login to netfilter once
 # cache_key with password: the lua default (%u) would let a temporary failure fall back to the negative entry
-# of a passdb lookup (master logins) and log "unknown user", which netfilter counts as failed login
+# of a passdb lookup (master logins) and reject the login as unknown user
 passdb {
   driver = lua
   args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes cache_key=%s:%u:%w