oops sorry was a bit fast answering, if you already have a crowdsec/lapi running you should add -no-api
so that it doesn’t try to start a local api (port conflict on 8080) but instead feed the alerts to the existing instance
crowdsec is easy to use too, you just have to get used to it
And the capacitly / leakspead doesn’t work exactly like the max retry / findtime in fail2ban.
If you want to direct ban on crowdsec you have to edit the scenario, change type from leaky to trigger, and comment with # capacity and leakspead.
This will make that crowdsec will trigger on only 1 line in your log file.
You can directly edit the “official” scenario, but generally I prefer to make my own one, to avoid change on update. Even if the update process should not touch the “tainted” scenario (the one you have changed locally).
And I don’t think that the actual postfix scenario on crowdsec will ban on RBL reject, I’m not exactly sure of that. But you should be able to test that as @thibault as explained.
Hello, related to this topic (customization of jails), your comments are welcome here : Request for comments : parsers & scenarios customization in the CrowdSec agent