I've got a few servers I'm looking to tighten security a bit more on in regards to Apache HTTPD and Postfix. Primarily I'd like to shut out the drive-by vulnerability scans. I currently use modsecurity and I have a number of the firehole lists tied into ipfw tables that are updated a number of times a day. SSH is only allowed from whitelisted addresses so I'm not looking to do more there.
I tinkered around a bit with fail2ban but I was not very impressed as it seemed to catch very little. I'm taking a look at crowdsec now. I'm curious what others have experienced with it. Good, bad, ugly?
I tinkered around a bit with fail2ban but I was not very impressed as it seemed to catch very little. I'm taking a look at crowdsec now. I'm curious what others have experienced with it. Good, bad, ugly?
(