Add Guezli/mailcow collection#1822
Open
Guezli wants to merge 1 commit into
Open
Conversation
One-command install of a layered Crowdsec stack for Mailcow running on the host. Bundles the official postfix + dovecot collections together with my Mailcow-specific scenarios (slow SASL bf, honeypot usernames, internal-F2B feed) and proven third-party IMAP/POP slow-pattern scenarios from melite + hitech95. Items pulled in: - crowdsecurity/postfix (collection) - crowdsecurity/dovecot (collection) - Guezli/mailcow-f2b-bans (parser) - Guezli/postfix-sasl-bf (scenario) - Guezli/postfix-honeypot-users (scenario) - Guezli/mailcow-f2b-feed (scenario) - melite/dovecot-slow-bf (scenario) - melite/dovecot-time-based-bf (scenario) - hitech95/mail-generic-bf (scenario) All referenced items already in the hub index. hublint check clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
One-command install of a layered Crowdsec stack for Mailcow
running on the host (Crowdsec on the Mailcow host, not inside the Mailcow Docker
network). Bundles the official
crowdsecurity/postfix+crowdsecurity/dovecotcollections together with my Mailcow-specific scenarios (slow SASL bruteforce,
honeypot usernames, internal-F2B propagation) and the proven third-party
IMAP/POP slow-pattern scenarios from
meliteandhitech95.cscli collections install Guezli/mailcowbrings up the whole Mailcow defensein one shot.
Items referenced
crowdsecurity/postfixcrowdsecurity/dovecotGuezli/mailcow-f2b-bans(parser)netfilter-mailcowban linesGuezli/postfix-sasl-bfGuezli/postfix-honeypot-usersGuezli/mailcow-f2b-feedmelite/dovecot-slow-bfmelite/dovecot-time-based-bfhitech95/mail-generic-bfAll referenced items already exist in the hub master index.
hublint checkis clean (0 warnings, 0 errors).
Checklist
collections,parsers,scenariosreferencing existing hub items.mdwith installation command, item-by-item rationale, and acquisition examples for the three Mailcow containers (postfix / dovecot / netfilter-mailcow)hublint checkcleanZoeyVid/npmplusreferencesopenappsec/openappsec; many third-party collections includecrowdsecurity/*collections)AI assistance
Claude Code assembled the collection YAML and rendered the documentation
based on the live Mailcow setup I've been running for several months
(scenarios are deployed and active on a production VPS). Item selection
and acquisition recommendations are my own.