You can Enhance your security by enable roundcube section
Roundcube does have captcha plugins available which will mitigate this, but users will complain if they have to type in a captcha to login for mail.
Fail2ban provides an easy solution for this.
First up, we need to add roundcube into
enabled = false
port = http,https
filter = roundcube
action = iptables-multiport[name=roundcube, port="http,https"]
logpath = [YOUR PATH TO ROUNDCUBE HERE]/logs/errors
maxretry = 5
findtime = 600
bantime = 3600
[YOUR PATH TO ROUNDCUBE HERE] in the above to your actual roundcube folder
Next, we need to create a filter.
failregex = IMAP Error: Login failed for . from <HOST>(\. . in .?/rcube_imap\.php on line \d+ \(\S+ \S+\))?$
Now we have the basics in place, we need to test out our filter.
For that, we use