Messages

@Patrick M. Hausen

Thank you for the feedback, they are always welcome.

> - Distributed setup is a real pain when the hub is to be OPNsense, because credentials remote machines use to send events get overwritten every so often if you are not ultra careful. OK, operator error, but a bit of POLA violation, too. Reset to localhost and new secret happens much too easily.

I'm sorry about this, but the aspect you're talking about cannot really be adjusted on our end since it's mainly related to OpnSense. You could run a distributed WAF/IDS setup directly on the machines themselves, which is more the way larger system usually leverage CrowdSec.

> - The blocklists available for free tier users are not well maintained and essentially worthless. Specifically while free tier users contribute to the main CrowdSec blocklist we do not get to subscribe to it for free.

Well sorry about the feeling around the Free Tier BL. it's updated several time a day and shares back depending on what you share too. So if you setup isn't sending back signals or just on a specific scenario like bruteforce, you'd get back some bruteforce BL. We contribute to free tier users by offering the scenario, engine, rules, the free tier and free BL so I think there is quite some reciprocal sharing. If we give all the BLs for free too, we simply have no business model anymore and cannot maintain the FOSS part of the system.

> - There is no affordable (like 100 $/€/£ per year) subscription offer for home users which I would seriously consider.

It depends highly on what you're looking to improve, if it's alert retention, there is actually a package to just boost this. If it's a BL, no I don't think we have anything in this range, but a lot in the range of 360€ yearly. I know it's a gap, but for a B2B offer, this is the lowest price point we could come up with so far. We tried lower price points but had no specific adoption boost covering the gap.

> So I stopped using it entirely. I currently have a running subscription for Q-Feeds and I am quite satisfied with the results.

CrowdSec is first and foremost a WAF and IDS, sharing threats between your machines and within the global network.
Indeed if the goal was to have rather Feeds for $100/y, the offer from qfeeds may be more adapted to your context.


to @cookiemonster:
 
> At the moment, the CrowdSec package for OPNsense is fully functional on the command line but its web interface is limited; you can only list the installed objects and revoke decisions. For anything else you need the shell or the CrowdSec Console. Which means most of the existing and new functionality is unmanageable from the plugin. For instance I can't use SPOA for haproxy on OPN when using the OPN haproxy plugin. If you are still willing to listen to my points (thank you for the offer) I shall open a new post so we can discuss them. In the open I suspect will be suitable for other users too. If you agree. Again, thank you. Just confirm and I will.

Sure, I think the product team would be delighted to exchange. Feel free to contact us (my 1st name @crowdsec.net) and open the exchange. I don't know what relies on OpnSense's team shoulder and what's on our own regarding this specific point tbh, neither what's doable or not but we can discuss it. Also, again, if you want to run a larger, more complex setup, I'd encourage you to use an autonomous instsance of CrowdSec. Also of note, you can use our CrowdSec Skill for Claude if you want.

@cookiemonster: I'm interested in the discussion about CrowdSec.

The product is free (security engine, scenarios, vpatch, WAF rules, Claude skill, etc.) and is MIT-licensed.
A blocklist is shared amongst users who share signals, for free, and many more are also free of charge.
There is 0 cost on the OpnSense integration.

So I'd be interested to understand your feelings better (or maybe it's about the SaaS console)?
If you have time and the will to discuss this, please PM me.

@dan786: Don't hesitate to discuss those points on our discourse.

The tables populated by CrowdSec are entirely dynamic. <TL/DR> It contains the IP your local machine blocks and a part of what the other in the network are blocking. The 1st step is really about checking your "stack health" in the SaaS console (or using the Claude Skill we published) to see that everything is properly configured.

The default 4h ban is meant to avoid a lengthy ban, since any IP caught locally will have its ban refreshed if needed, and if it is globally aggressive, it'll be added to a global blocklist (reputation vs. behavior).

CrowdSec now runs on hundreds of thousands of servers and we are confident the software is stable, behaving as intended, but this doesn't mean we can't have an OpenSense integration issue. So step 1: stack health or check the config with a Claude + the crowdsec skill. If it's cleared, please raise a bug and we'll investigate.

yup, sorry, OpenSense, obviously my bad, but the observation remains correct.
The firewall is dropping the table CrowdSec is populating, hence the feeling the firewall is doing the job all alone :-)

@ruzamai: Can you check how many times the rule that drops this table has been triggered?

Hi there, I'm allowing myself just a few observations:

> [...] There's constant pressure to upsell.

On the FOSS product, there is zero upsell. The security engines, scenarios, virtual patches, and OAWSP CRS ruleset are all 100% free.
One place you may see an upsell is in the SaaS console's free tier. The reason is that this product is not free, not for you or for us, since we store the attacks your servers are receiving. There is a free tier, which is entirely optional for the use of CrowdSec as Homelab users. For professionals, if you need supervision, alerts, provisioning, QoL, etc., this is where the SaaS product is useful and where you get upsell CTAs.

[...] I've noticed that Crowdsec has never blocked anything that my firewall rules don't block anyway.

It's then likely that you use only the IDS module (the one reading logs), with a few scenarios, and probably not exposed over the Internet. Because usually, Firewalls don't filter some ports that need to be opened (like HTTP or vpn, sometimes SSH, etc.) and those are scanned several thousand times a day, which is where CrowdSec WAF & IDS are helpful. Also, maybe check the SaaS console to see the health of your instance and whether you have log parsing, the scenario installed, etc. The logic is dynamic blocking based on behavior, rather than static filtering via firewall rules.

[...] Crowdsec claimed it had blocked nearly 20k attacks, all of which however were already blocked by the firewall

Normally, if a packet is dropped by your firewall, the related request should never reach the security engine for treatment.
CrowdSec Bouncer installs an IPset on your Linux firewall, and your firewall drops it, making it seem like it's your firewall dropping, but in fact, it's CrowdSec populating an IPset that your firewall is dropping.


Bests,

Philippe.

I have also been running (and still do) Crowdsec which I like a lot. If only they had a hobbyist license tier for e.g. 100€ per year. Now it's free edition with quite some limitations or something around 90€ per month - prohibitive, unfortunately.

Thanks for the kind words.

Just to be clear, the IDS, IPS, WAF, and all rulesets and scenarios have absolutely no limitations.
The only limited features are in the SaaS and the ones for corporations (auto-enrolment, alert context, AI-driven list, etc.) and the ones that are costly for us (like storing 1Y of incident history).

You even get a large and frequently updated blocklist in the free tier.
Premium, AI and Platinum blocklists are our paid products indeed.

Hi guys, Philippe from the CrowdSec team.
We're glad you show interest in the product.
Currently, we are finalizing the v1.0 and packaging for debian.
A container will also soon be available, as well as a CentOS package.

As you can guess, we had queries for ports on a lot of OS & distros and we will have hard time to produce them all in a timely manner. What we can offer though is a repo on our site or Github to provide community compiled packages or ports, and we'll be more than happy to. If the team needs to support a community build, it will to the best of its time and capacities. that being said, we chose Golang also because of its very high portability.

As for privacy, we are based in France. To put it mildly, we are under one of the strictest data privacy regulations on earth. We are currently feeding the paperwork beast with all the proper processes, forms, applications, tools, declarations and all that jazz. Takes a bit of time and a lot of money for the lawyers, but be sure that we are working on it.

To put it short, we don't export your logs and no data of yours. To benefit from the network reputation system for free, you have to share your own findings. When you block one IP because of a bad behavior, 3 things and only those 3 are sent back to us: 1/ The timestamp 2/ Offending IP 3/ Scenario it triggered.

Hope this brings some answers to your legitimate concerns.