Alfi

Hi,

Reading the thread I decided to give it a go, I went ahead and configured crowdsec. I have a few questions, if I may, here’s the setup:

• I have set up the basic collections/parsers (mainly nginx/linux/sshd/base-http-scenarios/http-cve)
• I only have two services open on the firewall, https and ssh (no root login, ssh key only)
• I have set up the firewall bouncer.

If I understand correctly, any attack detected will result in the ip being banned via iptables rule (for a configured duration, by default 4 hours).

• Is there any added value to run the nginx bouncer on top of that, or any other?
• cscli hub update/upgrade will fetch new definitions for collections if I undestand correctly. Is there any need to run this regularly, scheduled with let’s say a cron job, or does crowdsec do that automatically in the background?

Do you have a link to a documentation concerning retention/cleanup for instances?