Re:Crowdsec: A Fail2Ban alternative written in Go
by UI_at_80x24 on Monday October 19, 2020 @02:53PM
(#24829602)
Not enough people do this. Using country-level block-lists dropped the number of IP/Port scans we have received down to sub 1% of totals. It may not be an elegant approach to the problem but it is VERY effective.
[ Parent
| on HN ]
Re:Crowdsec: A Fail2Ban alternative written in Go
by Philippe_H on Monday October 19, 2020 @05:21PM
(#24831168)
We'll (soon) provide a Backoffice, where you can choose which IP you decide to ban (based on their activities, like bot scrapping, bruteforcing, etc.) but also add some 3rd party blacklist, block some AS or ranges, Tor exit nodes or VPN. This is all being builded right now, but in a couple of months, should be available.
Re:Crowdsec: A Fail2Ban alternative written in Go
by 10000truths on Monday October 19, 2020 @06:59PM
(#24831977)
Changing the default port takes a lot less effort than finding and using a country-level block list, and is just as effective in cutting down intrusion attempts.