Attackers usually target many servers at once. Today, when a NethServer blocks an attacker, every other NethServer still has to detect the same attacker on its own.
Proposed solution
Share blocked attackers across all NethServer and NethSecurity machines with a subscription.
- Every IP blocked by CrowdSec is sent to a central server.
- An IP reported by at least X different machines goes into a shared blocklist.
- CrowdSec downloads the shared blocklist every 15 minutes and blocks those IPs.
- A new Threat Shield page in the CrowdSec app lets the admin:
- enable or disable the shared blocklist and the other blocklists accessible only with Threat Shield entitlement
- check whether an IP is blocked by one of these blocklists
- Requires a subscription with the Threat Shield entitlement. Without it, the page explains what is missing.
Additional context
Mockup: https://www.figma.com/design/OsYqPXdkKJz0tBJRsiQgAf/NethServer-shared-file?node-id=5052-67725&t=Y5JZZT2M3PICjkfo-4
See also
Attackers usually target many servers at once. Today, when a NethServer blocks an attacker, every other NethServer still has to detect the same attacker on its own.
Proposed solution
Share blocked attackers across all NethServer and NethSecurity machines with a subscription.
Additional context
Mockup: https://www.figma.com/design/OsYqPXdkKJz0tBJRsiQgAf/NethServer-shared-file?node-id=5052-67725&t=Y5JZZT2M3PICjkfo-4
See also