61
Thoughts on crowdsec (lemmy.ca)
submitted 3 months ago by to c/selfhosted@lemmy.world
23 comments fedilink hide all child comments
 

I have been running crowdsec on my OpenWRT firewall for a bit now, I am just curious as to what others think about it?

Thank you @irmadlad the webui you suggested is showing the logs a lot better than my vibe coded HA plug ins (both my ssh honey pot and my plug in showed nothing) looking over the logs shows so much activity that is happening.

you are viewing a single comment's thread
view the rest of the comments
[–] 18 points 3 months ago (2 children)

i run it on opnsense. When my services were on individual subdomains each with their own certificate, they got hit a lot and crowdsec blocked lots of bots and scripts

I ultimately moved all my services to a wildcard sub-subdomain, and poof all the bots went away and now crowdsec doesn't do much other than block port scanners which the firewall does anyway.

it's not worth the hassle to uninstall though.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 5 points 3 months ago (1 child)

    I also haven't seen any bot activity after I started using wildcard sub domains. My ISP blocks all incoming on common ports so I also use uncommon ports. I assume the combination of the two makes it too time consuming to find me.

    I hid my ssh port with a wireguard connection so I also don't see any attempts on my ssh port anymore either. My logs, including fail2ban, are quiet and boring.

    It's nice to have a quiet corner of the internet for myself.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 3 months ago

    My logs, including fail2ban, are quiet and boring.

    Every once in a while, I'll tail my f2b logs, almost half heartily hoping I find an anomaly. But, no...it's a snoozefest. pFsense out there on the edge, just doing it's job.

  • permalink
  • fedilink
  • source
  • parent