- lemmyvore@feddit.nlEnglish29 days
crowdsec has always struck me as a really odd approach to security. You give out your logs to strangers and block IPs based on their say-so.
The cause and effect are so far removed that I can’t wrap my head about how it’s supposed to be efficient. It’s been proven in real-world tests that it lags badly behind the first waves of new vulnerabilities and by the time it starts blocking IPs that were related to those attacks the attackers have moved on and there are also patches available.
The “thousands of IPs blocked” image reminds me of that WWII airplane bullet-holes image.
29 daysI don’t believe there are any logs being transferred, just the abusive IPs are shared with the central DB.
So if an IP starts hitting a ton of rules (like .env access, repeated 403s, 404s, 429s, etc… Or specific AppSec rules) then that IP is blocked and sent to their central DB where it’s pushed out to everyone running crowdsec.
On my setup crowdsec has been more effective than cloudflare at stopping scanners and bots from overloading things, cloudflare just lets basically everything through so I stopped using it.
That said I’m curious if you remember the source of the real world tests, because I’d love to see what’s actually better.
- non_burglar@lemmy.worldEnglish29 days
On my setup crowdsec has been more effective than cloudflare at stopping scanners and bots from overloading things
Cloudflare is in the business of keeping infrastructure up and working. Any security benefits of CF are secondary.
I have similar setup on my home server except my Crowdsec & Anubis live in a dockerised VPS proxy that tunnels over WireGuard to the real server behind OPNSense. Saves me a ton not having bandwidth obliterating AI crawlers hit my internet bill. As an added bonus, I can move or shutdown the public VPS entry if things get too ‘spicy’ without any downtime on connections via the VPN.
