wiki.iridonia.fr [PPJ]

apt install debian-archive-keyring
apt install -y curl gnupg apt-transport-https
mkdir -p /etc/apt/keyrings
curl -fsSL https://packagecloud.io/crowdsec/crowdsec/gpgkey | gpg --dearmor > /etc/apt/keyrings/crowdsec_crowdsec-archive-keyring.gpg

vi /etc/apt/sources.list.d/crowdsec_crowdsec.list

Ajouter:
deb [signed-by=/etc/apt/keyrings/crowdsec_crowdsec-archive-keyring.gpg] https://packagecloud.io/crowdsec/crowdsec/any any main
deb-src [signed-by=/etc/apt/keyrings/crowdsec_crowdsec-archive-keyring.gpg] https://packagecloud.io/crowdsec/crowdsec/any any main

apt update
apt-get install crowdsec

#Si iptables est utilisé.
apt-get install crowdsec-firewall-bouncer-iptables

#Si nftables est utilisé.
apt-get install crowdsec-firewall-bouncer-nftables
 

cscli machines list
cscli bouncers list

Editer /etc/crowdsec/acquis.d/sshd.yaml et relancer le service systemctl restart crowdsec.service

journalctl_filter:
  - _SYSTEMD_UNIT=ssh.service
labels:
  type: sshd
source: journalctl

cscli metrics

# On doit retrouver un tableau Acquisition Metrics ,
 avec une ligne journalctl:journalctl-_SYSTEMD_UNIT=ssh.service,
Lines read, Lines parsed,Lines unparsed,Lines poured to bucket,
Lines whitelisted

#Attention à Lines unparsed

cscli capi status
Loaded credentials from /etc/crowdsec/online_api_credentials.yaml
Trying to authenticate with username [ID] on https://api.crowdsec.net/
You can successfully interact with Central API (CAPI)
Sharing signals is enabled
Pulling community blocklist is enabled
Pulling blocklists from the console is enabled

cscli collections install crowdsecurity/sshd 
cscli collections install crowdsecurity/linux
cscli collections install crowdsecurity/whitelist-good-actors

• Création d'un compte de machine

cscli machines add mon-nouveau-serveur --auto -f -
Machine 'mon-nouveau-serveur' successfully added to the local API.
url: http://0.0.0.0:8080
login: mon-nouveau-serveur
password: [la clef]

• Création d'un bouncer

cscli bouncers add bouncer-mon-nouveau-serveur
PI key for 'bouncer-mon-nouveau-serveur':
[la clef]

Reprendre l'installation des packages comme vu plus haut.

Editer: /etc/crowdsec/local_api_credentials.yaml

url: http://[ip du serveur central]:8080
login: mon-nouveau-serveur
password: [la clef machine]

Editer: /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml

api_url: http://[ip du serveur central]:8080/
api_key: [la clef bouncer]

Relancer le service crowdsec et le bouncer.

systemctl restart crowdsec
systemctl restart crowdsec-firewall-bouncer

Par exemple:

cscli collections install crowdsecurity/sshd 
cscli collections install crowdsecurity/linux

#on restart crowdsec
systemctl restart crowdsec

Affiche les ip qui sont ban , et d'autres informations

cscli decisions list