Features · Intrusion detection
Intrusion detection
Watch the attacks first. Block them when you're ready.
Astrari installs CrowdSec with an nftables firewall bouncer on the servers you choose. It reads the logs your services already write, recognises attack patterns, and bans the source address at the firewall — after you've seen what it would block and decided to let it.
What it does
Monitor before Protect
Every server starts in Monitor: the events timeline shows each attack and what would have been blocked, and nothing is blocked. Switch to Protect when the picture looks right. You can switch back at any time; existing bans then simply expire.
Bans with limits built in
Bans are time-limited — four hours by default, doubling for repeat offenders up to seven days. A safety cap counts distinct banned addresses — 100 in ten minutes by default. If it is reached, only the noisy web-scanner rules (and any single rule that is clearly misfiring) are paused and you are alerted; brute-force and exploit rules keep banning, existing bans stay in force, and the pause lifts on its own after a quiet hour.
Your own addresses stay safe
Allowlisted addresses are never banned. Add your own IP in one click when you enable it, and allowlist further addresses or ranges for the whole organisation or a single server.
Works with what's already there
Where fail2ban, LFD (csf) or cPHulk already protects a service, CrowdSec observes that service rather than competing with it, unless you choose otherwise. Supported on cPanel and Plesk servers as well as plain Linux.
What it recognises
- ▸ SSH password guessing, including slow attempts spread over time
- ▸ WordPress login and XML-RPC brute force, user enumeration and wp-config probing
- ▸ Exploit attempts against known web CVEs, plus SQL injection, XSS and path-traversal probing, from your access logs
- ▸ Web scanners, bad bots and probing for admin panels and config files
- ▸ Mail and FTP login attacks (Professional plan and above)
- ▸ cPanel and Plesk control panel login attacks (Professional plan and above)
Example event
SSH brute force from 203.0.113.42 — banned for 4 hours
Repeated failed SSH logins within a minute. In Protect mode the address was banned at the firewall; in Monitor the same event is shown as would-have-been-blocked.
How it works
- 1
Check compatibility
From the server's Intrusion page, Astrari checks the operating system, the services present and their log locations. Nothing is installed at this stage.
- 2
Install in Monitor
One click installs CrowdSec and the firewall bouncer. Events start appearing within minutes, labelled with what would have been blocked.
- 3
Switch to Protect
When you're satisfied, confirm the switch. Attacking addresses are banned automatically, within the ban limits and safety cap.
- 4
Benefit from the shared blocklist
Addresses that high-confidence detections see attacking several Astrari-protected servers are shared with the others, so they can be blocked before they reach you.
Plans
Not included on Starter. Basic covers SSH and web; Professional, Agency and White-label cover every service — SSH, web, mail, FTP and control panels. Compare plans.
Good to know
- ▸ Supported on Ubuntu, Debian, and AlmaLinux, Rocky Linux, RHEL and CloudLinux 8 and 9.
- ▸ Bans are applied from log evidence, so they stop an attacker's next requests rather than the very first one. An in-request web application firewall is on the roadmap.
See it on your own servers
The free Starter plan covers one website and one Linux server. The agent installs with one command and reports its first scan within a minute.