Comment

Comment on CrowdSec vs Fail2Ban - What to use?

I’ve been using crowdsec … but I’ve yet to see anyone banned but myself so far. Is everyone else having to write tons of whitelist parsers? I could whitelist my IP but I feel like that’s sidestepping the issue and doesn’t address friends/family also getting banned, coffeeshops, etc.

Feels like I’m missing something as so far it’s been quite a pain to configure

source

Sort:hotnew top

Matty_r@programming.dev ⁨2⁩ ⁨weeks⁩ ago
Where did you have it setup? Is your proxy configured to forward the real IP?

source
- Noggog@programming.dev ⁨2⁩ ⁨weeks⁩ ago
  It’s set up on the same box as my caddy install. I believe it’s getting passed the real IP because that’s what gets banned, and what I type in to unban it.
  
  It just sees normal operations as http probing. Like if some other service goes down, my GetHomepage will then 404 and that’s seen as probing. It bans surprisingly quick. Even after just one or two events (normal for someone just visiting the homepage) it’ll just kick em right out
  
  I’ve been having to inspect every alert and hand write whitelist parsers to whitelist 404s or whatever it may be for that app. Slowly accumulating a workable collection… but seems like I’m missing something as no one else seems to complain about this in threads like these
  
  source