Jeremy Davis's picture

Crowdsec certainly looks pretty cool. I'll keep a bit of an eye on it...

Also, that log output you shared is using the socket (i.e. the first line notes an instance of the termplate: 'ssh@13-10.0.254.1:22-10.0.0.1:44938.service').

So it's still a crazy mystery...