Crowdsec: A Fail2Ban alternative written in Go(github.com)

Crowdsec: A Fail2Ban alternative written in Go

https://github.com/crowdsecurity/crowdsec

97 comments

I like the idea of a Fail2Ban alternative, but I'm not sold on the idea of sending information to a third party. It may be optional to upload/download the malicious IP addresses, but the text on this project's GitHub page doesn't indicate that it is optional.

My immediate thought is "Fail2ban works. I don't need or want communication with a 3rd party right now."

golem146 anni fa

I think that's fair, and I had the same initial reaction. However, people are generally fine with DMARC or other crowdsourced spam signals, so it's not clearly bad.

I haven't looked at the source, but it should be easy to turn the crowdfiltering off or self-host if you have your own larger enterprise, no ?

It also depends on what exactly is transmitted. Transmitting all IP addresses in the clear might be bad, sending out hashes might be better ?

I think it's actually a good idea to try to detect those IP at scale. On your own individual server, you just see a million login attempts from a million different nodes on a botnet. But if you have millions of servers report the bad IPs and aggregate, you can see patterns and hopefully catch whole botnets.

klodolph6 anni fa

> However, people are generally fine with DMARC or other crowdsourced spam signals, so it's not clearly bad.

DMARC isn't a crowdsourced spam signal. And from my memories chatting with people running mail servers—the crowdsourced spam filtering is fairly controversial.

golem146 anni fa

Apologies, I was thinking of the spamhaus list, which I'm also not sure now is crowdsourced in the sense most people would use.

But most email providers build spamfilters using 'crowdsourced' techniques between their users (if enough users mark a sender spam it might be marked spam for all users).

And while that may be controversial, it's also highly effective.

monadic26 anni fa

Speaking from personal experience working with these reputation warehouses and with handling a good deal of incoming and outgoing email volume, they aren't any more effective than other IP-based spam heuristics and if everyone configured their DKIM correctly these warehouses would be largely obsolete. I don't see a problem with crowdsourcing heuristic data per se, but email is a much narrower field than internet traffic at large and I can see a lot of the ways that poorly configured fail2ban type software could accidentally ban a lot of valid traffic.

kenniskrag6 anni fa

> Transmitting all IP addresses in the clear might be bad, sending out hashes might be better

How many IP adresses are valid? Can't you hash them all and compare them with the hash you receive?

2^32 IPs is 4GB * 4 Bytes (1 IP) + 4GB * size of the hash should be the needed space I think.

_jal6 anni fa

1) That is not what DMARC is.

2) I won't be using any "security" tool that automatically shares details on active mitigation efforts.

> I think it's actually a good idea to try to detect those IP at scale.

It is! But not with my machines.