Alternative to Fail2Ban: CrowdSec

[klausagnoletti]

CrowdSec can be seen upon as a modern version on Fail2Ban only that it varies in a number of ways; most notably it leverages crowdsourced threat intelligence. This means that - like f2b it can parse local log files (and more, but that's a different story) to detect attacks. Intelligence on attacks is shared (anonymously!) with other users and blocklists based upon crowdsourced threat intelligence is automatically downloaded. Also, CrowdSec is capable of taking more advanced decisions like ressource abuse of various kinds.
Just to emphasize: CrowdSec is free (as in both speech and beer) and open source. I am head of community and an avid used myself. I would advice you to take a look at our docs or watch the talk I did at ShellCon last month if you find is interesting.
This project was built with Fail2Ban in mind; the founders have great respect for it and admire the guys who started the project a lot. So the idea has always been to build something that acknowledges this heritage.

Let me know what you think and reach out if you have any questions. I'll be happy to help you out as much as I can.

[imthenachoman]

Hello. I will definitely check it out. I've been a bit caught up with personal matters and my home server hasn't been operational for a while (PSU failed and I haven't replaced it yet).

From what you wrote it does sound promising. I will check it out and try to install it in a VM.

[lkraav]

Nice growth hack work here @klausagnoletti I'm definitely interested in CrowdSec now

👍 cc @szepeviktor

[szepeviktor]

@klausagnoletti Will CrowdSec Central API be the ultimate single blacklist?

[klausagnoletti]

@klausagnoletti Will CrowdSec Central API be the ultimate single blacklist?

@szepeviktor Yes and no :-) Yes it will be the ultimate global blacklist but you will also be able to do local blacklisting as well that only works with your own agent(s) obviously.