Hi, I am also facing the same problem. When dovecot is accessed through a web mail, the rip is logged as 127.0.0.1 (localhost).
/Aug 1 16:28:04 mailspace dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<suja>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<XllGt+DiPQB/AAAB>/ So I am also unable to configure fail2ban with dovecot. Is there a way we can log the actual remote IP ? Thanks and regards, Suja -- View this message in context: http://dovecot.2317879.n4.nabble.com/Wrong-remote-IP-rip-in-mail-log-using-IMAP-login-tp35176p43548.html Sent from the Dovecot mailing list archive at Nabble.com.