- The products are for the platform administrator only: every administrator page of the package (Toolkit, Sign-up, Cashier, Mailbox API, Security, Backup) now also refuses mailcow API keys (mailcow gives every API request the admin role, read-only keys too); domain administrators and mailbox users, also an administrator logged in as one of them, are sent back to their own area as before.
- The "SOGo as this mailbox in a new tab" button is now for the platform administrator only; domain administrators keep mailcow's own SOGo button.
- A test checks that every page of the package is public on purpose, CLI only or behind the administrator check.
Changelog von Security für mailcow
Jede veröffentlichte Version, die neueste zuerst. Downloads findest du in deinem Konto; Abonnements und Tests bekommen immer die neueste Version, Lifetime-Lizenzen bekommen Updates innerhalb ihres Update-Zeitraums.
0.7.1
Neueste- New: Backup for mailcow (its own license, System > Backup): scheduled, encrypted backups of mailcow in a local folder and on Google Drive, with retention, verification and restore from the admin page.
- Backups use mailcow's own backup script (mail, encryption keys, redis, rspamd, postfix, the database — your choice), packed into one archive and encrypted on the server with GnuPG (AES-256, with integrity protection) under your passphrase, before they reach the local folder or Google Drive. Each backup has a manifest (components, sizes, SHA-256, passphrase id, versions). The archives decrypt with plain gpg too.
- Schedule: times and weekdays of your choice (server time); a missed slot runs once when the server is back. Retention: the newest N copies locally and the newest N on Google Drive. E-mail on failure or after every backup.
- Google Drive with your own Google OAuth client (scope drive.file: the module sees only the files it created), resumable uploads in 32 MiB chunks that continue after a network error, the token encrypted at rest.
- Restore from the page, local or from Google Drive, per component (typed confirmation): the SHA-256 is checked, the archive decrypted, and the components restored with the same steps as mailcow's restore, without its questions; the database restore stops mailcow for a few minutes. The module's own secrets survive a redis restore. Verify decrypts and reads a whole backup without restoring it.
- Several passphrases: a new one applies to the next backups, older backups restore with their own; on a new server, add the old passphrase and connect the same Google client.
- Without a valid license the scheduled backups and uploads stop; verify, restore and delete keep working, so the data can always be recovered.
- New: Security for mailcow (its own license, System > Security): attack detection with a history, bans through mailcow's own fail2ban (netfilter) and optionally Cloudflare, account protection and alerts.
- Reads what mailcow already logs (dovecot, postfix, SOGo and netfilter from mailcow's redis; the web server's access log and failed mailcow UI / API logins through the host agent) every minute. Records are kept per minute in mailcow's database (default 90 days), so the history survives mailcow's log trimming; the first run imports what mailcow still keeps.
- 13 rules for what mailcow's own fail2ban misses: slow brute force, password spraying, repeat offenders (addresses banned again and again by fail2ban), web login brute force (SOGo, mailcow UI, API), web exploit and 404 scans, relay probing, protocol scans, spam floods, targeted mailboxes (distributed attacks), sending spikes, logins from many addresses and logins after failures (a guessed password). Thresholds, windows, actions and ban durations can be changed per rule.
- Monitor only by default: incidents say what would have been done. With automatic actions on, addresses are banned in mailcow's fail2ban denylist (and, by choice, as Cloudflare IP Access Rules for proxied web hosts) for the rule's duration; account rules can limit sending or disallow login. Private addresses, the allowlists (the module's and mailcow's), the server's own addresses and addresses that signed in successfully to a mailbox recently are never banned automatically.
- The page: overview (24-hour totals, 14-day chart, most active addresses, targeted mailboxes, active incidents), incidents (seen, resolved, false positive with allowlisting), events search, bans (the module's, mailcow's own temporary bans, the denylist, history), one address (PTR, look-up links, ban / allowlist) and one mailbox (logins by address, failures, sends; disallow login, end IMAP / POP3 sessions, require a password change, limit sending), rules, settings and an audit log of every action. A red shield next to the System menu shows open high / critical incidents.
- Alerts by e-mail and Telegram from a chosen severity, with an hourly limit, and an optional daily summary. A ban removed in mailcow's Fail2ban page counts as lifted; expired bans are lifted even without a license, and uninstall.sh lifts them all.
- Fixed: the Mailbox API admin page called a Sign-up function it did not load and asked mailcow to add a script that does not exist.