Skip to content

CrowdSec: share blocked IPs with all subscribed machines #8184

Description

@gsanchietti

Attackers usually target many servers at once. Today, when a NethServer blocks an attacker, every other NethServer still has to detect the same attacker on its own.

Proposed solution

Share blocked attackers across all NethServer and NethSecurity machines with a subscription.

  • Every IP blocked by CrowdSec is sent to a central server.
  • An IP reported by at least X different machines goes into a shared blocklist.
  • CrowdSec downloads the shared blocklist every 15 minutes and blocks those IPs.
  • A new Threat Shield page in the CrowdSec app lets the admin:
    • enable or disable the shared blocklist and the other blocklists accessible only with Threat Shield entitlement
    • check whether an IP is blocked by one of these blocklists
  • Requires a subscription with the Threat Shield entitlement. Without it, the page explains what is missing.

Additional context

Mockup: https://www.figma.com/design/OsYqPXdkKJz0tBJRsiQgAf/NethServer-shared-file?node-id=5052-67725&t=Y5JZZT2M3PICjkfo-4

See also

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

  • Status
    In Progress

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions