Admin web interface (through nginx

Questions
1

Your question

Stalwart 0.16.10 on Ubuntu, running as a systemd service. The automatic ban has blocked the server’s own public IP, 140.150.227.70. Because of that, the admin web interface (through nginx on the same server) returns 502, and our webmail on the same server can’t connect to IMAP. Incoming mail from Gmail does reach port 25. We need to remove that blocked IP, add it to the allowed IPs so it can’t happen again, and decide whether to adjust or turn off the automatic ban. What’s the safest way to do this from recovery mode?

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

Now I have enough to answer comprehensively.

Get in via recovery mode, then fix the ban and whitelist your own IP.

  1. Enter recovery mode. Stop the service, set the environment variables, and restart:

    STALWART_RECOVERY_MODE=1
STALWART_RECOVERY_ADMIN=admin:somepassword   # only if you can't log in normally

    This disables the MTA, task workers, and clustering, and serves the WebUI/JMAP management API on port 8080 (STALWART_RECOVERY_MODE_PORT), bypassing the banned-IP block since only that one management listener is active. Note: STALWART_RECOVERY_ADMIN is a backdoor credential — set it only for this maintenance window, then remove it before restarting normally.

  2. Remove the block on 140.150.227.70. It’s stored as a BlockedIp record. From the CLI:

    stalwart-cli query blockedip --where address=140.150.227.70
stalwart-cli delete blockedip --ids <id-from-above>

    Or delete it from the WebUI under Settings → Security → Blocked IPs.

  3. Add it to the allow list so it can’t be banned again. Create an AllowedIp record (Settings → Security → Allowed IPs, or via CLI):

    stalwart-cli create allowedip --field address=140.150.227.70

    Addresses on this list bypass rate limits and auto-banning entirely. (127.0.0.1/::1 are allowed by default, but your public IP is not, which is why your own server banned itself.)

  4. Adjust the auto-ban thresholds if you want to loosen them rather than disabling the feature outright. They live on the Security singleton (Settings → Security → Settings): authBanRate/authBanPeriod, abuseBanRate/abuseBanPeriod, loiterBanRate/loiterBanPeriod, scanBanRate/scanBanPeriod. Raising the rate values or lengthening the period gives more headroom before a ban triggers. There’s no single master “off” switch documented other than setting each *BanRate high enough that it won’t realistically trigger; the safer route for your own IP specifically is the allow-list entry above, since that bypasses banning for that address regardless of thresholds.

  5. Once fixed, unset STALWART_RECOVERY_MODE (and remove STALWART_RECOVERY_ADMIN) and restart the service normally.

Reference: Recovery mode, Auto-banning, IP address allow/block lists

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

nginx and the webmail both reach Stalwart through 140.150.227.70, so as far as Stalwart can tell every login and request they pass along comes from that one address. A run of failed webmail logins, or a scanner probing paths through nginx, is enough to get it banned.

You don’t need recovery mode for this. Loopback is never banned, so from the server itself you can point the CLI at 127.0.0.1 on the port nginx proxies to and delete the entry:

stalwart-cli --url http://127.0.0.1:8080 query blockedip
stalwart-cli --url http://127.0.0.1:8080 delete blockedip --ids <id>

If the admin login fails, set STALWART_RECOVERY_ADMIN=admin:<password> in the service environment, restart, and remove it again afterwards (Recovery mode | Stalwart).

I wouldn’t add the public IP to the allowed list or turn auto-ban off. Either way, everything coming through nginx would be exempt from banning. Point nginx’s proxy_pass and the webmail’s IMAP host at 127.0.0.1 and enable Proxy Protocol on those listeners (Proxy Protocol | Stalwart), so Stalwart sees the real client addresses and bans the attacker instead of your own proxy. The thresholds are at Auto-banning | Stalwart if the defaults turn out too strict. 0.16.10 is also quite a few releases behind, so an upgrade is due.