CrowdSec or Fail2ban?

1. Two tools, two models #

What really sets them apart.

The same starting point #

Fail2ban and CrowdSec both read logs and ban abusive addresses. Fail2ban, written in Python, does so server by server: a filter (regular expression) counts failures in a jail, then an action sets a local firewall rule. CrowdSec separates these steps and makes them shareable.

The comparison #

2. Which one to choose? #

Depending on your context.

Keep Fail2ban #

Fail2ban remains an excellent choice on a small isolated server, to protect SSH with no dependency or network service, when you need neither a dashboard nor sharing.

Choose CrowdSec #

• You manage several servers and want an attack seen on one to be blocked on all.
• You want to block at the reverse proxy, with a block page or captcha, not only at the firewall.
• You want to use community reputation to block before the first attack.
• You want to follow activity with Prometheus and Grafana.

3. Migrating safely #

Run both, then switch.

The method #

1. Install CrowdSec without a bouncer, next to Fail2ban: it observes and blocks nothing.
2. For one or two weeks, compare cscli alerts list with what Fail2ban bans, and spot false positives.
3. Add your trusted addresses to an allowlist.
4. Install the bouncer, check blocking, then stop Fail2ban.

cscli alerts list --since 24h
sudo fail2ban-client status sshd
# Quand tout est prêt :
sudo systemctl disable --now fail2ban

Avoid duplicates. Two tools managing the same firewall chains make troubleshooting harder: likewise, do not install two firewall bouncers on one machine.

Sources #

• Fail2ban
• CrowdSec
• Shattered : CrowdSec, bloquer les attaques