Enchance and Fail2Ban

AdamM

Try Crowdsec. It seems to work fine with v12. Does anyone have more information and use Crowdsec with v12?

mendozal

AdamM I use crowdsec with V12. Everything is straightforward except the default web server logs parser.

The webserver logs are in a different format in enhance so I implemented a custom parser. That's the only caveat.

opsshield

There is no known compatibility issue. We use Fail2ban to monitor logs with cPGuard and things are quite fine.

dweb

I'm also using Crowdsec with v12.

I just wish we hade a Cloudflare bouncer to use the free 50.000 shared list (like CSF does).
The only one in active development is the one that use workers, and for multiple domain it will require an active subscription with Cloudflare and also you need to manually add each new domain into the bouncer, and also there's no API to change failover mode.

I'm almost trying to create a CSF bouncer, so all crowdsec bans redirects to CSF and it does the job as I wish.

ronald

Fail2ban works fine on any Enhance server. Enhance uses UFW so the best option would be to keep this as is, then configure F2B to work with that. Create the jails you need, like for example for SSH and FTP.

net

F2B works great with UFW in Enhance. Easily block those scanners in Nginx too 🙂

JKSoftware

Hi again everyone,
Thanks again for all the replies, they were really helpful.
One last thing I wanted to ask. Is there any official or community guide for setting up Fail2ban or CrowdSec on Enhance servers? Just something simple to follow so we do not misconfigure anything, especially with UFW and the log paths on Enhance.
If there is a link or a documented example that you would recommend, I would really appreciate it.
Thanks once more for the support!

ivansalloum

JKSoftware Check out my guide on how I used UFW (plus nftables sets) with Fail2ban to build an advanced, adaptive firewall which works well with Enhance.

https://ivansalloum.com/how-i-built-an-adaptive-firewall-setup-with-ufw-and-fail2ban/

JohnB

ivansalloum Great writeup and I like your site design. Its very to the point and easy to read long posts.

ivansalloum

JohnB Thanks! Took me a full week and three AI copilots (ChatGPT, Gemini, and Claude) to get it looking the way I wanted 😂

presswizards

@ivansalloum Does fail2ban work with Enhance's log file format with no timestamps? I will read through and check out your post more.

ivansalloum

presswizards Just to clarify — my guide doesn’t rely on any Enhance’s logs at all. I’m using Fail2ban to monitor syslog for the firewall-generated entries, and that’s what triggers the bans.