iRedMail — Feature request: Fail2Ban Management Issues

Re: Feature request: Fail2Ban Management Issues

2026-10-15T15:49:30Z

To your point on multiple MUA's configured, this is very often the case. Then sometimes you have the user who is "absolutely sure" he updated all his clients but still gets banned randomly; then it turns out some old forgotten iPod gets pulled out of a drawer and turned on once in a while and tries to check mail... but even instances like that aside, it is very difficult to update a few MUAs without getting nailed for incorrect passwords at least once.

In all the details I posted, I also hope that my point about Unbanning not always fully working, making it necessary to restart fail2ban to truly unban clients, was not lost.

Re: Feature request: Fail2Ban Management Issues

2026-10-15T14:55:40Z

I appreciate your response, thank you! I'll wait for further development on this.

Re: Feature request: Fail2Ban Management Issues

2026-10-15T14:32:10Z

Hi @caretech.

1: You will get the search feature in upcoming EE release.
2: It's possible that user has several MUAs (e.g. desktop MUA, phone) configured with old password, they were still accessing IMAP/POP3 services right after password reset, which triggered the ban.

Fail2ban seems doesn't support "ignore this IP for 1 hour", i will try to figure out an alternative way to handle this issue. Stay tuned.

Feature request: Fail2Ban Management Issues

2026-10-15T14:15:02Z

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 2026090801 (Backend: pgsql, Date: 2026-09-15 19:52:54) iRedMail Enterprise Edition: https://www.iredmail.org/ee.html
- Deployed with iRedMail Easy or the downloadable installer? First deployed w/ installer, then migrated to EE recently
- Linux/BSD distribution name and version: Debian 12.15
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): PGSQL
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? Yes, iRedMail EE
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

We host thousands of users on a very busy server and our support reps find the Banned IP Address list basically unmanageable. This morning for example, there were at least 17 pages of banned addresses. The list is not searchable; the only way to search is to load 1 page at a time in the browser and use the browser's Find function. With more than a dozen pages to laboriously search one at a time, this is not workable.

Summary:
1. We need a way to search the banned IP address list.

2. Something is not quite right with fail2ban functionality since migrating to EE. Various times we will Unban an address in the admin interface but the user will continue to be banned on some ports. (For example, he might be able to connect to IMAP but not to SMTP, or vice versa). We need to restart fail2ban in order to clear the issue in these cases.

Today one of our techs was helping a customer reset his account password and of course the user got banned during the process. I told our support rep to just clear all 17+ pages of banned addresses since manually hunting all those pages is untenable. He used the Unban All button. The client was then able to send email but not receive. I logged into the server and issued "systemctl restart fail2ban" and that got the client out of IMAP jail.

Regarding #2, let me know if there's specific log data you need for this. I haven't been able to find meaningful log data beyond basic fail2ban info telling of found, banned, and unbanned addresses.

In general we find fail2ban pretty jumpy. It's almost impossible to lead a client through a password change without getting him banned -- this is a routine annoyance.