إعداد CrowdSec: محرك أمان مدعوم من المجتمع

curl -s https://install.crowdsec.net | sudo sh
sudo apt install crowdsec -y
sudo apt install crowdsec-firewall-bouncer-iptables -y
sudo systemctl status crowdsec

version: '3.8'
services:
  crowdsec:
    image: crowdsecurity/crowdsec:latest
    container_name: crowdsec
    restart: unless-stopped
    ports:
      - "8080:8080"
      - "6060:6060"
    volumes:
      - crowdsec_config:/etc/crowdsec
      - crowdsec_data:/var/lib/crowdsec/data
      - /var/log:/var/log:ro
    environment:
      - COLLECTIONS=crowdsecurity/linux crowdsecurity/nginx crowdsecurity/sshd

volumes:
  crowdsec_config:
  crowdsec_data:

sudo cscli collections list
sudo cscli collections install crowdsecurity/linux
sudo cscli collections install crowdsecurity/nginx
sudo cscli collections install crowdsecurity/sshd
sudo cscli hub update
sudo cscli hub upgrade

sudo cscli scenarios list
sudo cscli scenarios install crowdsecurity/ssh-bf
sudo cscli scenarios install crowdsecurity/http-bad-user-agent
sudo cscli scenarios install crowdsecurity/http-probing

sudo apt install crowdsec-firewall-bouncer-iptables -y

mode: iptables
update_frequency: 10s
api_url: http://localhost:8080/
api_key: مفتاح_API_الخاص_بك
deny_action: DROP
deny_log: true

sudo apt install crowdsec-nginx-bouncer -y
sudo cscli bouncers add nginx-bouncer

sudo cscli decisions list
sudo cscli decisions add --ip 1.2.3.4 --reason "حظر يدوي" --type ban --duration 24h
sudo cscli decisions add --range 1.2.3.0/24 --reason "حظر شبكة فرعية" --type ban
sudo cscli decisions delete --ip 1.2.3.4
sudo cscli decisions delete --all

sudo cscli console enroll مفتاح_التسجيل_الخاص_بك
sudo systemctl restart crowdsec

type: leaky
name: custom/brute-force
description: "كشف brute force مخصص"
filter: "evt.Meta.log_type == 'ssh_failed-auth'"
groupby: evt.Meta.source_ip
capacity: 5
leakspeed: 10m
blackholeduration: 4h
labels:
  service: ssh
  type: brute_force
  remediation: true

name: custom/whitelist
description: "عناوين IP موثوقة"
whitelist:
  reason: "عناوين IP موثوقة"
  ip:
    - "192.168.1.0/24"
    - "10.0.0.0/8"

sudo cscli metrics
curl http://localhost:6060/metrics

sudo apt update
sudo apt upgrade crowdsec crowdsec-firewall-bouncer-iptables
sudo cscli hub update
sudo cscli hub upgrade

sudo tail -f /var/log/crowdsec.log
sudo tail -f /var/log/crowdsec-firewall-bouncer.log
sudo cscli explain --file /var/log/auth.log --type syslog