CrowdSec Reviews and Details

Is CrowdSec good?

Social recommendations and mentions

• Did you have serious attacks on your exposed services before?

  This tool crowdsec.net is really interesting to mitigate and enact defense systems for different scenarios. Source: about 2 years ago

• What service can I use to ban users?

  You should check out https://crowdsec.net. More advanced, uses crowdsources cti to block attacks even before they happen. Also both nginx and captcha is supported. Disclaimer: I am head of community. Visit /r/CrowdSec or our Discord at https://discord.gg/crowdsec if you have questions :-). Source: over 2 years ago

• A 'leech-like' connection constantly established on my server

  Before falling too much in love with Fail2Ban try taking a look at https://crowdsec.net. Similar functionality but way more advanced (but easier to configure). New project that leverages the power of the crowd and shares information of attacks among users so they help each other out protecting themselves. Source: over 2 years ago

• Banning users for certain actions

  You could try out https://crowdsec.net. It’s an advanced FOSS framework for detecting a number of different attacks and not limited to just brute force attacks like Fail2Ban as /u/nonself suggests. The basic concept of CrowdSes is that it reads log, detects attacks, mitigates attacks (CrowdSec integrates directly into the Flask application) and shares information about those attacks with everyone else using... Source: over 2 years ago

• Block traffic from every country except the USA? - Apache2/SSH

  Not what you suggested but have you considered https://crowdsec.net? Not just a collaborative and more advanced version of Fail2Ban but in this case you want it because of the collaborative blocklist; we made an article showing that 92% of attacks was blocked in advanced by ip reputation before any attacks were performed. Disclaimer: I am head of community so I might be a bit biased. It’s still a cool FOSS project... Source: almost 3 years ago

• Large scale Internet SSH brute force attacks seem to have stopped here

  So in that way everybody using CrowdSec are helping each other out. More information at https://crowdsec.net. - Source: Hacker News / almost 3 years ago

• Large scale Internet SSH brute force attacks seem to have stopped here

  The CrowdSec folks have something similar to that: https://crowdsec.net/ https://github.com/crowdsecurity/crowdsec. - Source: Hacker News / almost 3 years ago

• [Newbie] Is my study path correct?

  You should consider adding CrowdSec to the list of tools. Here's an article on why CrowdSec's not just a Fail2Ban clone. Source: about 3 years ago

• Logging unauthorised attempts

  Something like that would be fairly trivial to do with CrowdSec. Currently there’s no support for Wireguard. This would require a log parser and a scenario which describes the two attacks in the article you point to. But, as I said it would be fairly trivial. There’s an existing parser and scenario which detect portscans via kmesg in syslog. So doing the same with Wireguard and dyndbg would be easy enough.... Source: about 3 years ago

• Looking for a reverse proxy firewall

  I'm trying to use CrowdSec (https://crowdsec.net/) to help protect my NAS but I'm unsure how to use Traefik or Nginx Proxy Manager due to DSM using ports 80/443. Is there anything else I can do to replace Synology's built in reverse proxy? Source: about 3 years ago

• Exposing Projects Externally Safely

  As u/Puptentjoe mentions, nothing else to do than a vpn if you are the only user. Otherwise reverse proxy and security software. I use Swag and Crowdsec. Source: about 3 years ago

• Homeserver log monitoring and alerts

  Not directly related to your question but ... Crowdsec is a security software that you can use to get notifications in case of intrusion alerts. Source: about 3 years ago

• Lots of bot attacks on website

  Maybe crowdsec is an option for you? Works really good for me and was easy to install/configure. Source: about 3 years ago

• fail2ban log says "banned" but IP still able to connect

  And for general routing behind Traefik I use Crowdsec Docker for monitoring traffic and blocking it. I did NMAP scan over VPN and I got banned :D Https://crowdsec.net/. Source: about 3 years ago

• pfBlockerNG as CrowdSec bouncer?

  Go to https://crowdsec.net/ and scroll down the page until you get to "Where to use it" you will see a bunch of icons. Under "Services" there a greyed out pfSense logo icon. Source: about 3 years ago

• Israel says its government websites were hit by cyber attack

  I use https://crowdsec.net/ and have helped Ukraine. I went from "ipset list crowdsec-blacklists" showing about 3,500 lines to almost 15,000 now. I'm being attacked. Source: over 3 years ago

• Docker with WAN facing containers and SSL

  I'd suggest swag. Includes all you need. Very easy to configure. I'd also add crowdsec for an additional security layer. Source: over 3 years ago

• Who's Attacking My Server?

  I don't know exaxtly what you mean by a distributed community run firewall but https://crowdsec.net/ collects information (anonymously) on the attacks users see and shares it with all other users after vetting them. So in this way the community helps itself (or each other, if you will). Currently around 800k signals are collected daily and around 19k ips are shared back to users as blocklists. - Source: Hacker News / over 3 years ago

• Who's Attacking My Server?

  Https://crowdsec.net/ can also do something like that, only more advanced in the attacks it detects and because it's sharing bad ips from users to everyone else. I love that users in this way are watching each other's back. - Source: Hacker News / over 3 years ago

• Who's Attacking My Server?

  How about using a tool like https://crowdsec.net/ that collects (basic, anonymious) information from users on the attacks they see, vets it and shares it back to all users via blocklists? Currently around 800k signals are collected and there's around 19k vetted bad ips in the blocklist. Sounds more reliable to me. - Source: Hacker News / over 3 years ago

• Who's Attacking My Server?

  That's one of many reason why https://crowdsec.net/ was created. It collects (anonymized) threat intelligence from all users, vets it and distributes it as relevant blocklists. Once there's enough users it will be a very effective way to fight bad guys. And unlike your suggestion it DOES make a difference. Currently around 800k signals are collected daily and there's around 19k vetted malevolent ips distributed to... - Source: Hacker News / over 3 years ago