New install, postfix / IMAP

oops sorry was a bit fast answering, if you already have a crowdsec/lapi running you should add -no-api so that it doesn’t try to start a local api (port conflict on 8080) but instead feed the alerts to the existing instance :wink:

crowdsec is easy to use too, you just have to get used to it :slight_smile:
And the capacitly / leakspead doesn’t work exactly like the max retry / findtime in fail2ban.

If you want to direct ban on crowdsec you have to edit the scenario, change type from leaky to trigger, and comment with # capacity and leakspead.

This will make that crowdsec will trigger on only 1 line in your log file.

You can directly edit the “official” scenario, but generally I prefer to make my own one, to avoid change on update. Even if the update process should not touch the “tainted” scenario (the one you have changed locally).

And I don’t think that the actual postfix scenario on crowdsec will ban on RBL reject, I’m not exactly sure of that. But you should be able to test that as @thibault as explained.

Hello, related to this topic (customization of jails), your comments are welcome here : Request for comments : parsers & scenarios customization in the CrowdSec agent