HowTo: CrowdSec de la zero pe Debian

CrowdSec = IPS colaborativ: citeste logurile, aplica scenarii comportamentale si blocheaza IP-urile ostile, cu reputatie globala. Instalare completa, pas cu pas.

1. Instalare

curl -s https://install.crowdsec.net | sudo sh
sudo apt -y install crowdsec
sudo systemctl status crowdsec

2. Acquisition (ce loguri citeste)

# ce loguri citeste (auto-detectat la instalare); adaugi nginx manual:
sudo tee -a /etc/crowdsec/acquis.yaml >/dev/null <<'EOF'
---
filenames:
  - /var/log/nginx/access.log
  - /var/log/nginx/error.log
labels:
  type: nginx
EOF
sudo systemctl reload crowdsec

3. Colectii (scenarii)

sudo cscli collections install crowdsecurity/nginx crowdsecurity/sshd \
  crowdsecurity/http-cve crowdsecurity/base-http-scenarios
sudo cscli collections list

4. Bouncer nftables

# bouncer = aplica blocarea in nftables
sudo apt -y install crowdsec-firewall-bouncer-nftables
sudo cscli bouncers list

5. Operare

sudo cscli metrics
sudo cscli decisions list
sudo cscli alerts list

6. Consola + testare

# test: adauga o decizie manuala si verifica blocarea
sudo cscli decisions add --ip 1.2.3.4 --duration 4h --reason test
sudo cscli decisions list
# consola (dashboard + blocklists comunitare):
sudo cscli console enroll <ENROLL_KEY>

Concluzie

Ai un IPS colaborativ care blocheaza automat atacurile din loguri, cu inteligenta comunitara. Il configuram si tunam pentru tine.