Crowdsec: A Fail2Ban alternative written in Go

Re:Crowdsec: A Fail2Ban alternative written in Go by ahendriksen on Monday October 19, 2020 @02:08PM (#24829062)

For me definitely! I have a tiny VPS running ARM that I use as a build server. I get so much SSH spam that it noticeably slows down the VPS (both with and without Fail2Ban)..

"Written in Go" signifies to me that it can be faster and more resource-efficient than Fail2Ban: a good reason to check it out.

[ Parent | on HN ]

Re:Crowdsec: A Fail2Ban alternative written in Go by InvaderFizz on Monday October 19, 2020 @03:35PM (#24830017)

Is this really much of a problem? I have a VPS that's been online for years, serving port 22. I average about 200k attempts per year. I have it set to pubkey only, root can't login at all. If you connect without sending a pubkey, it pretty much instantly tells you to go away. I don't bother with fail2ban.

Maybe I should start logging attempted pubkeys as a side project just to see what pops up.

[ Parent | on HN ]

Re:Crowdsec: A Fail2Ban alternative written in Go by abdusco on Monday October 19, 2020 @02:28PM (#24829313)

You should consider changing default SSH port. It helps a lot with the spam.

[ Parent | on HN ]

Re:Crowdsec: A Fail2Ban alternative written in Go by coolspot on Monday October 19, 2020 @05:55PM (#24831478)

Also adding port knocking.

https://netslovers.com/2018/02/28/port-knocking-server-secur...

[ Parent | on HN ]

Re:Crowdsec: A Fail2Ban alternative written in Go by blibble on Monday October 19, 2020 @02:44PM (#24829508)

and/or add an iptables rule that limits the rate, set high enough such that you'll never hit it

1 line in your iptables config

[ Parent | on HN ]