[nginx-botsearch]
enabled = true
port = http,https
filter = nginx-botsearch
logpath = /var/log/nginx/access.log
maxretry = 2
[nginx-botsearch]
enabled = true
port = http,https
filter = nginx-botsearch
logpath = /var/log/nginx/access.log
maxretry = 2
[nginx-botsearch]
enabled = true
port = http,https
filter = nginx-botsearch
logpath = /var/log/nginx/access.log
maxretry = 2
[Definition]
failregex = ^<HOST> - .* "(GET|POST|HEAD).*HTTP.*" 404
[Definition]
failregex = ^<HOST> - .* "(GET|POST|HEAD).*HTTP.*" 404
[Definition]
failregex = ^<HOST> - .* "(GET|POST|HEAD).*HTTP.*" 404
# Install agent
curl -s https://install.crowdsec.net | bash # Install firewall bouncer
apt install crowdsec-firewall-bouncer-iptables # Enroll in console
cscli console enroll <your-key> # Install a collection for nginx
cscli collections install crowdsecurity/nginx # Acquire the log file
echo "source: file\nfilenames:\n - /var/log/nginx/access.log\nlabels:\n type: nginx" > /etc/crowdsec/acquis.d/nginx.yaml # Restart
systemctl restart crowdsec
# Install agent
curl -s https://install.crowdsec.net | bash # Install firewall bouncer
apt install crowdsec-firewall-bouncer-iptables # Enroll in console
cscli console enroll <your-key> # Install a collection for nginx
cscli collections install crowdsecurity/nginx # Acquire the log file
echo "source: file\nfilenames:\n - /var/log/nginx/access.log\nlabels:\n type: nginx" > /etc/crowdsec/acquis.d/nginx.yaml # Restart
systemctl restart crowdsec
# Install agent
curl -s https://install.crowdsec.net | bash # Install firewall bouncer
apt install crowdsec-firewall-bouncer-iptables # Enroll in console
cscli console enroll <your-key> # Install a collection for nginx
cscli collections install crowdsecurity/nginx # Acquire the log file
echo "source: file\nfilenames:\n - /var/log/nginx/access.log\nlabels:\n type: nginx" > /etc/crowdsec/acquis.d/nginx.yaml # Restart
systemctl restart crowdsec
curl -fsSL https://defensia.cloud/install.sh | sudo bash -s -- --token <YOUR_TOKEN>
curl -fsSL https://defensia.cloud/install.sh | sudo bash -s -- --token <YOUR_TOKEN>
curl -fsSL https://defensia.cloud/install.sh | sudo bash -s -- --token <YOUR_TOKEN> - You have 1-2 servers and only need SSH protection
- You want zero network dependency
- You're comfortable writing and maintaining regex jails
- You don't need visibility into what's happening - You manage 10+ servers and want proactive threat intel
- You're comfortable with complex multi-component setup
- Crowd blocklists are worth more to you than a dashboard
- You don't mind sharing attack data with a third party
- Budget allows $29+/engine/month for the console - You want visibility into what's attacking your servers without setting up monitoring infrastructure
- You need WAF protection from access logs without configuring rules
- You manage Docker hosts and want container-aware security
- You want something that works out of the box with zero configuration
- Budget: free for 1 server, $9.90/server for Pro - fail2ban: github.com/fail2ban/fail2ban
- CrowdSec: github.com/crowdsecurity/crowdsec
- Defensia: github.com/defensia/agent (MIT license)
