CrowdSec Security
Intrusion detection wired into the proxy logs, with a graduated response from CAPTCHA to full block.
Background
CrowdSec reads the proxy and authentication logs and makes its decisions from recognized scenarios: scanning, bruteforce, probing of sensitive URLs. Decisions are enforced by a bouncer mounted in the proxy, on top of the community blocklist that accounts for most of the blocked volume.
Live metrics
Real numbers from the protection layer deployed in front of this site.
Technologies and tools used
Detection & scenarios
- CrowdSec Hub collections
- AppSec & virtual patching
- Custom parser
The Hub collections cover the proxy, authentication and SSH, with scenarios dedicated to known web CVEs.
Bouncers
The bouncer mounted in the proxy enforces decisions at the edge, whether they come from local scenarios or from the community blocklist.
Remediation
- Turnstile CAPTCHA
- CAPTCHA grace period
The response is graduated by severity, from a CAPTCHA to a full block.
Challenges
- Tuning the scenarios to limit false positives on legitimate traffic.
- Keeping detection light enough not to slow the services down.